diff --git a/.github/styles/base/Dictionary.txt b/.github/styles/base/Dictionary.txt index 5155d20e435..6d72be4ed8b 100644 --- a/.github/styles/base/Dictionary.txt +++ b/.github/styles/base/Dictionary.txt @@ -78,6 +78,7 @@ backporting backports backreference backreferences +baseten Bingbot wget meshtrust diff --git a/.github/workflows/ai-gateway-automated-tests.yaml b/.github/workflows/ai-gateway-automated-tests.yaml index 6f3eb0b4e62..b79c4bc61e0 100644 --- a/.github/workflows/ai-gateway-automated-tests.yaml +++ b/.github/workflows/ai-gateway-automated-tests.yaml @@ -9,8 +9,8 @@ on: konnect_domain: description: "Set to konghq.tech to run against .tech" required: false - konnect_event_gateway_min_version: - description: 'Minimum Konnect Event Gateway version for the get.konghq.com/ai quickstart (e.g. 2.2)' + konnect_ai_gateway_min_version: + description: 'Minimum Konnect AI Gateway version for the get.konghq.com/ai quickstart (e.g. 2.2)' required: false schedule: - cron: '0 0 * * MON' @@ -71,11 +71,11 @@ jobs: - name: Pre-pull AI Gateway quickstart dependencies run: docker pull ghcr.io/jqlang/jq:latest - - name: Set Event Gateway min version - if: ${{ inputs.konnect_event_gateway_min_version != '' }} + - name: Set AI Gateway min version + if: ${{ inputs.konnect_ai_gateway_min_version != '' }} env: - MIN_VERSION: ${{ inputs.konnect_event_gateway_min_version }} - run: echo "KONNECT_EVENT_GATEWAY_MIN_VERSION=$MIN_VERSION" >> $GITHUB_ENV + MIN_VERSION: ${{ inputs.konnect_ai_gateway_min_version }} + run: echo "KONNECT_AI_GATEWAY_MIN_VERSION=$MIN_VERSION" >> $GITHUB_ENV - name: Run tests working-directory: tools/automated-tests diff --git a/app/_ai_gateway_entities/ai-agent.md b/app/_ai_gateway_entities/ai-agent.md index 2cb29f462fa..f816da860e9 100644 --- a/app/_ai_gateway_entities/ai-agent.md +++ b/app/_ai_gateway_entities/ai-agent.md @@ -78,7 +78,7 @@ faqs: a: | Reference an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) by name or id in the AI Agent's [`access.auth_strategies`](#schema-aigateway-agent-access) array, the same field used on AI Models. An AI Agent - currently accepts up to one AI Auth Strategy reference. The AI Agent has its own top-level authentication + accepts up to one AI Auth Strategy reference. The AI Agent has its own top-level authentication mechanism, so attaching an authentication AI Policy directly to its `policies` field isn't supported. - q: How do I attach AI Policies to an AI Agent? @@ -92,6 +92,12 @@ faqs: signs each proxied request using static IAM credentials, environment auto-detection, or an assumed role. This is separate from [`access.auth_strategies`](#schema-aigateway-agent-access), which authenticates inbound clients rather than outbound requests to the upstream agent. See [Upstream authentication](#upstream-authentication). + + - q: How do I connect to an upstream agent that requires mTLS or serves a certificate from a private CA? + a: | + Set [`config.certificates`](#schema-aigateway-agent-config-certificates) for mTLS, or [`config.ca_certificates`](#schema-aigateway-agent-config-ca-certificates) for a private CA. + Both fields apply to `a2a` and `http` AI Agents. + See [Upstream TLS](#upstream-tls). --- ## What is an AI Agent? @@ -340,7 +346,11 @@ To restrict which AI Consumers or teams can reach a specific agent, use ACLs. Th For per-request authentication and identity validation, reference an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) in the [`access.auth_strategies`](#schema-aigateway-agent-access) array, the same way you would for an [AI Model](/ai-gateway/entities/ai-model/#access-control). The AI Agent has its own top-level authentication mechanism: you configure the authentication through AI Auth Strategies. See [AI Policy scopes](/ai-gateway/entities/ai-policy/#ai-policy-scopes) for details. -An AI Agent currently accepts up to one AI Auth Strategy reference. ACLs are evaluated only after the AI Consumer's identity is resolved through this authentication step. +An AI Agent accepts up to one AI Auth Strategy reference. ACLs are evaluated only after the AI Consumer's identity is resolved through this authentication step. + +### CEL-based ACLs + +{% include md/ai-gateway/v2/cel-acls.md entity="AI Agent" anchor="#schema-aigateway-agent-access" %} ## Upstream authentication @@ -373,6 +383,23 @@ config: `config.upstream` is available regardless of the AI Agent's [`type`](#schema-aigateway-agent-type); it applies to `a2a` and `http` Agents alike. +## Upstream TLS + +{% include md/ai-gateway/v2/upstream-tls.md name='AI Agent' schema_prefix='schema-aigateway-agent-config' %} + +These fields apply to both `a2a` and `http` AI Agents. + +In the following example, the AI Agent presents the `agent-client-cert` certificate to the upstream and verifies the upstream against the `kongair-internal-root-ca` CA: + +```yaml +config: + url: https://booking-agent.internal.kongair.com + certificates: + - agent-client-cert + ca_certificates: + - kongair-internal-root-ca +``` + ## Attach AI Policies To enforce security, transformation, or governance controls on agent traffic (for example, request validation, PII detection, request logging), attach [AI Policies](/ai-gateway/entities/ai-policy/) to the agent. Add policy names or IDs to the AI Agent's [`policies`](#schema-aigateway-agent-policies) field. Multiple AI Policies can attach to one AI Agent; each runs independently in the request lifecycle. diff --git a/app/_ai_gateway_entities/ai-ca-certificate.md b/app/_ai_gateway_entities/ai-ca-certificate.md index 152616e7a71..0966f1b54e7 100644 --- a/app/_ai_gateway_entities/ai-ca-certificate.md +++ b/app/_ai_gateway_entities/ai-ca-certificate.md @@ -29,6 +29,10 @@ related_resources: url: /ai-gateway/entities/ai-sni/ - text: AI Data Plane Certificate url: /ai-gateway/entities/ai-data-plane-certificate/ + - text: AI MCP Server entity + url: /ai-gateway/entities/ai-mcp-server/ + - text: AI Agent entity + url: /ai-gateway/entities/ai-agent/ faqs: - q: How is an AI CA Certificate different from a {{site.base_gateway}} CA Certificate? a: | @@ -39,6 +43,12 @@ faqs: authority, carries no private key, and is used to verify the certificate a client or an upstream server presents. An AI Certificate is an identity the data plane uses itself: it carries a private key and is presented to complete a TLS handshake. + - q: Can AI MCP Servers and AI Agents use an AI CA Certificate to verify their upstreams? + a: | + Yes. + Reference one or more AI CA Certificates by name in the `config.ca_certificates` field of an [AI MCP Server](/ai-gateway/entities/ai-mcp-server/#upstream-tls) or [AI Agent](/ai-gateway/entities/ai-agent/#upstream-tls). + The AI MCP Server or AI Agent then uses them to verify the upstream's certificate, which lets it connect to upstreams signed by a private or internal CA. + If you don't set the field, the default trust store is used. --- ## What is an AI CA Certificate diff --git a/app/_ai_gateway_entities/ai-certificate.md b/app/_ai_gateway_entities/ai-certificate.md index 37a3d1b1304..b0f8d43e801 100644 --- a/app/_ai_gateway_entities/ai-certificate.md +++ b/app/_ai_gateway_entities/ai-certificate.md @@ -31,6 +31,10 @@ related_resources: url: /ai-gateway/entities/ai-vault/ - text: AI Data Plane Certificate entity url: /ai-gateway/entities/ai-data-plane-certificate/ + - text: AI MCP Server entity + url: /ai-gateway/entities/ai-mcp-server/ + - text: AI Agent entity + url: /ai-gateway/entities/ai-agent/ faqs: - q: How is an AI Certificate different from a {{site.base_gateway}} Certificate? a: | @@ -62,6 +66,13 @@ faqs: No. The `key` and `key_alt` fields are write-only. They're accepted on create and update, but never returned by a read. Keep your own copy of any key you register, or store it in an [AI Vault](/ai-gateway/entities/ai-vault/) and register a reference to it instead of the literal value. + + - q: Can AI MCP Servers and AI Agents present an AI Certificate to their upstreams? + a: | + Yes. + Reference the AI Certificate by name in the `config.certificates` field of an [AI MCP Server](/ai-gateway/entities/ai-mcp-server/#upstream-tls) or [AI Agent](/ai-gateway/entities/ai-agent/#upstream-tls). + The AI MCP Server or AI Agent then presents it as its client certificate, which lets it connect to upstreams that require mutual TLS (mTLS). + The AI Certificate must include a private key. --- ## What is an AI Certificate? diff --git a/app/_ai_gateway_entities/ai-mcp-server.md b/app/_ai_gateway_entities/ai-mcp-server.md index c0f028d7c3b..2d71f39142a 100644 --- a/app/_ai_gateway_entities/ai-mcp-server.md +++ b/app/_ai_gateway_entities/ai-mcp-server.md @@ -87,8 +87,8 @@ faqs: Server's [`access.auth_strategies`](#schema-aigateway-mcpserver-access) array, the same way you would for an [AI Model](/ai-gateway/entities/ai-model/#access-control) or [AI Agent](/ai-gateway/entities/ai-agent/#access-control). This is supported for `conversion-listener`, - `listener`, and `passthrough-listener` modes. An AI MCP Server currently accepts up to one AI Identity - Provider reference. The AI MCP Server has its own top-level authentication mechanism, so attaching an + `listener`, and `passthrough-listener` modes. An AI MCP Server accepts up to one AI Auth Strategy + reference. The AI MCP Server has its own top-level authentication mechanism, so attaching an authentication AI Policy directly to its `policies` field isn't supported. - q: Can I attach a rate-limiting policy to an AI MCP Server? @@ -105,6 +105,11 @@ faqs: clients, and from [`config.server.tools_list_auth`](#schema-aigateway-mcpserver-config-server-tools-list-auth), which only authenticates the one-time fetch of an `upstream-server`'s tool list. See [Upstream authentication](#upstream-authentication). + + - q: How do I connect to an upstream that requires mTLS or serves a certificate from a private CA? + a: | + Set [`config.certificates`](#schema-aigateway-mcpserver-config-certificates) for mTLS, or [`config.ca_certificates`](#schema-aigateway-mcpserver-config-ca-certificates) for a private CA. + See [Upstream TLS](#upstream-tls). --- ## What is an AI MCP Server? @@ -114,7 +119,7 @@ Create an AI MCP Server to connect AI applications such as [Claude](https://clau Because MCP endpoints run directly on {{site.ai_gateway}}, you don't need to host and scale MCP infrastructure separately. The same authentication, rate limiting, and observability policies you apply to traditional API traffic automatically cover MCP traffic, giving you consistent governance across both HTTP and MCP clients. {:.warning} -> **Note:** MCP traffic is API-level traffic, not LLM request/response flows. Authenticate MCP traffic through an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) referenced in [`access.auth_strategies`](#schema-aigateway-mcpserver-access), the same as AI Models and AI Agents. Standard API-level policies (rate limiting, logging) still apply to MCP traffic through the [`policies`](#schema-aigateway-mcpserver-policies) field. AI Policies that operate on LLM prompt/response flows (such as prompt guards or model routing) won't apply here. +> **Note:** MCP traffic is API-level traffic, not LLM request/response flows. Authenticate MCP traffic through an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) referenced in [`access.auth_strategies`](#schema-aigateway-mcpserver-access), the same as AI Models and AI Agents. Standard API-level policies (rate limiting, logging) still apply to MCP traffic through the [`policies`](#schema-aigateway-mcpserver-policies) field. AI Policies that operate on LLM prompt/response flows, for example, prompt guards or model routing, won't apply here. ## MCP versions @@ -122,7 +127,7 @@ Because MCP endpoints run directly on {{site.ai_gateway}}, you don't need to hos For more information, see [MCP version support](/ai-gateway/mcp-version-support/). -### Configure protocol-revision behavior {% new_in 2.1 %} +### Configure protocol-revision behavior The following `config.server` fields control protocol-revision behavior: @@ -193,7 +198,8 @@ rows: - use_case: "Secure MCP endpoints with AI Consumer identity or OAuth tokens" example: "Reference an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) (`key-auth` or `openid-connect`) in [`access.auth_strategies`](#schema-aigateway-mcpserver-access). Advertise [protected resource metadata](#protected-resource-metadata) through `access.metadata` so MCP clients can discover the authorization server." - use_case: "Rate limiting" - example: "Use [Rate Limiting](/ai-gateway/policies/rate-limiting/) or [Rate Limiting Advanced](/ai-gateway/policies/rate-limiting-advanced/) Policy to control MCP request volume per AI Consumer or AI Consumer Group." + example: "Set [`rate_limiting`](#rate-limiting) to cap requests per MCP method or tool. + Use [Rate Limiting](/ai-gateway/policies/rate-limiting/) or [Rate Limiting Advanced](/ai-gateway/policies/rate-limiting-advanced/) Policy to control MCP request volume per AI Consumer or AI Consumer Group." - use_case: "Track all MCP traffic and ACL decisions." example: "Enable request and response logging through [AI logging Policies](/ai-gateway/policies/?category=logging) and audit trails." - use_case: "Traffic control" @@ -333,7 +339,7 @@ You can use a `listener` AI MCP Server to pull tools from multiple `upstream-ser 3. **Tool caching**: Each `upstream-server` caches its tool list for the duration specified by [`config.tools_cache_ttl_seconds`](#schema-aigateway-mcpserver-config-tools-cache-ttl-seconds). Set to `0` to fetch fresh on every client request. -4. **Tool name disambiguation**: If two upstreams expose tools with the same name, the listener prepends the service name to avoid collisions (e.g., `weather-service/get-forecast`). Disable this with [`config.server.preserve_upstream_tool_names`](#schema-aigateway-mcpserver-config-server-preserve-upstream-tool-names): true if you're sure names won't collide. +4. **Tool name disambiguation**: If two upstreams expose tools with the same name, the listener prepends the service name to avoid collisions (for example, `weather-service/get-forecast`). Disable this with [`config.server.preserve_upstream_tool_names`](#schema-aigateway-mcpserver-config-server-preserve-upstream-tool-names): true if you're sure names won't collide. 5. **Tool invocation**: When a client calls a tool, the listener routes the request to whichever upstream registered it. From the client's perspective, it's one call to one URL. @@ -452,7 +458,7 @@ An MCP client such as [Claude Desktop](https://claude.ai/download), Cursor, or [ ## Access control -Once you expose tools through an AI MCP Server, anyone who can reach the endpoint can attempt to call them unless you gate access to known AI Consumers. To authenticate AI Consumers calling a `conversion-listener`, `listener`, or `passthrough-listener` AI MCP Server, reference an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) by name or ID in the [`access.auth_strategies`](#schema-aigateway-mcpserver-access) array. This is the same mechanism used by [AI Models](/ai-gateway/entities/ai-model/#access-control) and [AI Agents](/ai-gateway/entities/ai-agent/#access-control). An AI MCP Server currently accepts up to one AI Auth Strategy reference. The AI MCP Server has its own top-level authentication mechanism, so attaching an authentication AI Policy directly to its [`policies`](#schema-aigateway-mcpserver-policies) field isn't supported; authentication is configured exclusively through AI Auth Strategies. See [AI Policy scopes](/ai-gateway/entities/ai-policy/#ai-policy-scopes) for details. +When you expose tools through an AI MCP Server, anyone who can reach the endpoint can attempt to call them unless you gate access to known AI Consumers. To authenticate AI Consumers calling a `conversion-listener`, `listener`, or `passthrough-listener` AI MCP Server, reference an [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) by name or ID in the [`access.auth_strategies`](#schema-aigateway-mcpserver-access) array. This is the same mechanism used by [AI Models](/ai-gateway/entities/ai-model/#access-control) and [AI Agents](/ai-gateway/entities/ai-agent/#access-control). An AI MCP Server accepts up to one AI Auth Strategy reference. The AI MCP Server has its own top-level authentication mechanism, so attaching an authentication AI Policy directly to its [`policies`](#schema-aigateway-mcpserver-policies) field isn't supported; authentication is configured exclusively through AI Auth Strategies. See [AI Policy scopes](/ai-gateway/entities/ai-policy/#ai-policy-scopes) for details. `upstream-server` AI MCP Servers don't accept an `access.auth_strategies` reference. Configure [`config.server.tools_list_auth`](#schema-aigateway-mcpserver-config-server-tools-list-auth) instead to authenticate to the upstream when fetching its tool list; see [Tool-list authentication](#tool-list-authentication). `conversion-only` AI MCP Servers have no `access` field at all, since they never accept incoming MCP traffic directly. @@ -525,6 +531,69 @@ config: role_session_name: kong-ai-gateway ``` +## Upstream TLS + +{% include md/ai-gateway/v2/upstream-tls.md name='AI MCP Server' schema_prefix='schema-aigateway-mcpserver-config' %} + +These fields work in every [server mode](#server-modes) that connects to an upstream: `conversion-only`, `conversion-listener`, `passthrough-listener`, and `upstream-server`. +They have no effect in `listener` mode, because a listener only aggregates tools from other AI MCP Servers and doesn't connect to an upstream itself. + +In the following example, the AI MCP Server presents the `mcp-client-cert` certificate to the upstream and verifies the upstream against the `kongair-internal-root-ca` CA: + +```yaml +config: + url: https://mcp.internal.kongair.com + certificates: + - mcp-client-cert + ca_certificates: + - kongair-internal-root-ca +``` + +## Rate limiting + +The AI MCP Server [`rate_limiting`](#schema-aigateway-mcpserver-rate-limiting) field caps how many requests the server accepts for a specific MCP method or [tool](#tools). +For example, you can limit a tool to a set number of requests per second and per day, or limit all `tools/call` requests per minute so a retrying agent can't call tools thousands of times. + +{:.warning} +> The `rate_limiting` field is supported only in `conversion-listener` and `passthrough-listener` modes. +> Other [server modes](#server-modes) reject it. + +Each limit follows these rules: + +- It targets either an MCP method or a tool name, not both. +- Each combination of target and window can appear only once. +- You can set several windows for the same target, for example per second and per day. + +If a limit breaks any of these rules, the {{site.konnect_short_name}} API rejects the AI MCP Server configuration with a `400` error that points to the invalid entry, for example `rate_limiting.limits[1]`. + +A request counts against every limit it matches. +For example, a `tools/call` request for a tool counts against both a `tools/call` limit and a limit on that tool. +In a JSON-RPC batch request, each message counts separately. + +Each {{site.ai_gateway}} data plane node keeps its own counters and enforces the limits independently. + +When an MCP client's request exceeds a limit, the AI MCP Server rejects it with an HTTP `429` status and a JSON-RPC error with code `-32023`. + +The following example limits a tool per second and per day, and limits all `tools/call` requests per minute: + +```yaml +rate_limiting: + limits: + - tool: search_flights + limit: 10 + window_size: 1 + - tool: search_flights + limit: 1000 + window_size: 86400 + - method: tools/call + limit: 100 + window_size: 60 +``` + +{:.info} +> `rate_limiting` applies to all requests that reach the AI MCP Server, regardless of the client. +> To limit requests per AI Consumer or AI Consumer Group, attach a [Rate Limiting](/ai-gateway/policies/rate-limiting/) or [Rate Limiting Advanced](/ai-gateway/policies/rate-limiting-advanced/) Policy. + ## ACL tool control When exposing MCP servers through {{site.ai_gateway}}, you may need granular control over which authenticated [AI Consumers](/ai-gateway/entities/ai-consumer/) can discover and invoke specific tools. The MCP Server's ACL feature lets you define access rules at both the default level (which applies to all tools) and per-tool level (for fine-grained exceptions). @@ -553,7 +622,7 @@ This way, AI Consumers only interact with tools appropriate to their role, while For modes that support server-level ACL configuration (`conversion-listener`, `listener`, `passthrough-listener`, `upstream-server`), two attribute types determine what the AI MCP Server evaluates ACL rules against: 1. **`consumer`** (default). Evaluates against the resolved AI Consumer identity. -1. **`oauth_access_token`**. Evaluates against a claim extracted from the OAuth access token. Set [`access.access_token_claim_field`](#schema-aigateway-mcpserver-access-access-token-claim-field) to a jq filter (for example, `.user.email` for a nested claim). The token is validated by the [`openid-connect` AI Auth Strategy](/ai-gateway/openid-connect/) referenced in [`access.auth_strategies`](#schema-aigateway-mcpserver-access) — on this server if it accepts MCP traffic directly (`conversion-listener`, `listener`, `passthrough-listener`), or on the `listener` that aggregates it if this is a `conversion-only` or `upstream-server` AI MCP Server. If [`access.metadata`](#schema-aigateway-mcpserver-access-metadata) is also set, validation happens through the generated AI MCP OAuth2 Policy configuration instead; see [Protected resource metadata](#protected-resource-metadata). +1. **`oauth_access_token`**. Evaluates against a claim extracted from the OAuth access token. Set [`access.access_token_claim_field`](#schema-aigateway-mcpserver-access-access-token-claim-field) to a jq filter (for example, `.user.email` for a nested claim). The token is validated by the [`openid-connect` AI Auth Strategy](/ai-gateway/openid-connect/) referenced in [`access.auth_strategies`](#schema-aigateway-mcpserver-access). The strategy goes on this server if it accepts MCP traffic directly (`conversion-listener`, `listener`, `passthrough-listener`), or on the `listener` that aggregates it if this is a `conversion-only` or `upstream-server` AI MCP Server. If [`access.metadata`](#schema-aigateway-mcpserver-access-metadata) is also set, validation happens through the generated AI MCP OAuth2 Policy configuration instead; see [Protected resource metadata](#protected-resource-metadata). When evaluating a scope-based ACL rule against a `2026-07-28` client, {{site.ai_gateway}} matches on scope hierarchy: a broader scope granted to the token satisfies a rule naming a narrower one. Earlier protocol revisions keep exact-match comparison between the granted scope and the rule. @@ -563,6 +632,10 @@ For modes that support server-level ACL configuration (`conversion-listener`, `l When `access.acl_attribute_type` is `consumer`, you can gate access by individual [AI Consumers](/ai-gateway/entities/ai-consumer/) (using username, UUID, or custom ID) or by [AI Consumer Group](/ai-gateway/entities/ai-consumer-group/) membership. This flexibility lets you define rules at the right level: deny a specific user, allow a tier-based group, or mix both in the same ACL. The runtime checks the authenticated AI Consumer's identity and group memberships against your `allow` and `deny` lists. +### CEL-based ACLs + +{% include md/ai-gateway/v2/cel-acls.md entity="AI MCP Server" anchor="#schema-aigateway-mcpserver-access-acls" scope="server-level " allow_and_deny_together=true %} + ### How default and per-tool ACLs work The runtime evaluates access using a two-tier system: @@ -698,7 +771,7 @@ To monitor and troubleshoot MCP traffic, enable logging and audit trails through ## Scope of support -The AI MCP Server runtime supports MCP operations and upstream interactions, while certain advanced features and non-HTTP protocols are not currently supported. The following table summarizes what is supported and what is outside the current scope. +The AI MCP Server runtime supports MCP operations and upstream interactions, while certain advanced features and non-HTTP protocols are not supported. The following table summarizes what is supported and what is outside the supported scope. {% feature_table %} diff --git a/app/_ai_gateway_entities/ai-model.md b/app/_ai_gateway_entities/ai-model.md index d2e89e3b730..814d642134a 100644 --- a/app/_ai_gateway_entities/ai-model.md +++ b/app/_ai_gateway_entities/ai-model.md @@ -111,7 +111,7 @@ At request time, the AI Model mediates traffic between clients and upstream AI P 1. Translates between the request and response format chosen for the AI Model and the upstream AI Provider's native format. 1. Resolves upstream connection coordinates (protocol, host, port, path, HTTP method) from the selected target and its [AI Model Provider](/ai-gateway/entities/ai-model-provider/), unless the target is a self-hosted model. 1. Authenticates to the upstream LLM service using credentials stored on the [AI Model Provider](/ai-gateway/entities/ai-model-provider/) entity. -1. Decorates the upstream request with per-target configuration (such as temperature or token-limit overrides) declared on [`targets[].config`](#schema-aigateway-model-targets). +1. Decorates the upstream request with per-target configuration (for example, temperature or token-limit overrides) declared on [`targets[].config`](#schema-aigateway-model-targets). 1. Records usage statistics (tokens, cost, latency) for attached log AI Policies, and optionally the full request and response when payload logging is enabled. 1. Fulfills requests to self-hosted models using the supported native format transformations. @@ -184,6 +184,20 @@ rows: {% endtable %} +### Expose all capabilities + +To expose every capability that the AI Model's [`type`](#schema-aigateway-model-type) and providers support, set `capabilities` to `["*"]`. You don't have to list each capability, and new capabilities that a later release adds are included automatically. + +* A `model` type AI Model exposes all `model` capabilities. +* An `api` type AI Model exposes only `batches` and `files`. The `skills` capability is never selected by `*` and must be listed explicitly. +* Capabilities that the provider doesn't support, or that the data plane version doesn't support, are omitted. +* If you list other values next to `*`, they are ignored. + +An empty or absent `capabilities` list still exposes no capabilities. You must set `*` explicitly. + +{:.warning} +> A wildcard AI Model can create many routes. For example, an AI Model with `capabilities: ["*"]` and `formats: [{type: "*"}]` on an OpenAI provider creates approximately 25 routes. These routes use every path under the AI Model's base path, and they can conflict with an AI MCP Server or AI Agent that uses the same path. + ## Request and response formats By default, AI Models expose all endpoints using OpenAI-compatible format. {{site.ai_gateway}} provides a single, standardized interface across all providers, so you can swap providers (OpenAI, Anthropic, self-hosted, etc.) without changing client code or integration logic. @@ -231,7 +245,42 @@ rows: When a native format is set, only the corresponding provider is supported with its specific APIs. -### Passthrough {% new_in 2.2 %} +### Expose all formats + +To accept every API format, set `formats` to `[{type: "*"}]`. Combined with [`capabilities: ["*"]`](#expose-all-capabilities), the AI Model listens on every {{site.ai_gateway}} endpoint: + +```yaml +capabilities: ["*"] +formats: + - type: "*" +``` + +The `*` format has the following behavior: + +* It selects every format in the preceding table except `passthrough`, which can't be combined with other formats. Formats that the data plane version doesn't support are omitted. For example, `typesafe` is selected only if you're running {{site.ai_gateway}} 2.2 or later. +* If you list other formats next to `*`, they are ignored. +* An absent or empty `formats` list still defaults to `openai`. +* Your provider must support the formats that `*` selects. A provider might not support every format. + +### Use multiple formats + +An AI Model can list more than one format. It then exposes the capabilities of each format, so clients can call the same AI Model with different API shapes. For example, the following AI Model serves all capabilities for both the `openai` and `cohere` formats: + +```yaml +capabilities: ["*"] +formats: + - type: openai + - type: cohere +``` + +If you set explicit capabilities, a capability that no listed format supports is rejected. A capability that only some of the listed formats serve is exposed for those formats only. + +When two formats serve the same path, for example `realtime` on `/realtime` for `openai` and `gemini`, the AI Model keeps the endpoint of the `openai` format. If you list formats and capabilities explicitly, you get a routing conflict warning for the endpoint that is omitted. + + + + +### Passthrough If your upstream exposes a format {{site.ai_gateway}} doesn't recognize, set `formats[].type` to `passthrough`. Request and response bodies are forwarded byte-for-byte, without `Content-Type` enforcement or schema validation. @@ -347,7 +396,7 @@ By default, applications or services making requests to the AI Model endpoint mu * [`header_param`](#schema-aigateway-model-config-route-model): matches a value in the request headers, indexed by header name. * [`path_param`](#schema-aigateway-model-config-route-model): matches a value present in the request path, indexed by path parameter name. -Each strategy pairs with a [`values`](#schema-aigateway-model-config-route-model) array (currently limited to one value) listing the alias that routes to this AI Model. When a routing rule is set, clients can send the alias value (in the body, a header, or the path, depending on the strategy chosen) instead of the upstream model name. This is useful when you want to decouple your client API from upstream provider changes. For example, you could expose an alias like `production-chat-model` while swapping the underlying upstream model from `gpt-4o` to `claude-3-sonnet` without your clients noticing. +Each strategy pairs with a [`values`](#schema-aigateway-model-config-route-model) array (limited to one value) listing the alias that routes to this AI Model. When a routing rule is set, clients can send the alias value (in the body, a header, or the path, depending on the strategy chosen) instead of the upstream model name. This is useful when you want to decouple your client API from upstream provider changes. For example, you could expose an alias like `production-chat-model` while swapping the underlying upstream model from `gpt-4o` to `claude-3-sonnet` without your clients noticing. When [`config.route.model`](#schema-aigateway-model-config-route-model) isn't set, {{site.ai_gateway}} creates a default model selector using the AI Model's name and format. @@ -362,6 +411,10 @@ To control how consumers authenticate before their access is evaluated, configur > > For more information, see [OIDC token authentication](/ai-gateway/entities/ai-auth-strategy/#oidc-token-authentication). +### CEL-based ACLs + +{% include md/ai-gateway/v2/cel-acls.md entity="AI Model" anchor="#schema-aigateway-model-access" %} + ## Attach AI Policies Attach an AI Policy to an AI Model to add security, observability, governance, rate limiting, and cost optimization to all requests through that model. For example, you can add guardrails ([AI Prompt Guard](/ai-gateway/policies/ai-prompt-guard/), [AI Lakera Guard](/ai-gateway/policies/ai-lakera-guard/)), enable [logging and metrics](/ai-gateway/policies/?category=logging), audit and [compliance controls](/ai-gateway/policies/ai-sanitizer/), cache responses, or [rate-limit](/ai-gateway/policies/ai-rate-limiting-advanced/) LLM traffic. diff --git a/app/_ai_gateway_entities/ai-provider.md b/app/_ai_gateway_entities/ai-provider.md index ebb095a1c01..ea31470c66b 100644 --- a/app/_ai_gateway_entities/ai-provider.md +++ b/app/_ai_gateway_entities/ai-provider.md @@ -87,6 +87,7 @@ When configuring an [AI Model](/ai-gateway/entities/ai-model/), you reference an {% icon_card icon="metaai.svg" title="Llama" cta_url="/ai-gateway/ai-providers/llama/" %} {% icon_card icon="xai.svg" title="xAI" cta_url="/ai-gateway/ai-providers/xai/" %} {% icon_card icon="dashscope.svg" title="Alibaba Cloud DashScope" cta_url="/ai-gateway/ai-providers/dashscope/" %} +{% icon_card icon="baseten.svg" title="Baseten" cta_url="/ai-gateway/ai-providers/baseten/" %} {% icon_card icon="cerebras.svg" title="Cerebras" cta_url="/ai-gateway/ai-providers/cerebras/" %} {% icon_card icon="deepseek.svg" title="DeepSeek" cta_url="/ai-gateway/ai-providers/deepseek/" %} {% icon_card icon="ollama.svg" title="Ollama" cta_url="/ai-gateway/ai-providers/ollama/" %} diff --git a/app/_ai_gateway_policies/ai-prompt-compressor/index.md b/app/_ai_gateway_policies/ai-prompt-compressor/index.md index 65572272d2e..2fa6d3a818a 100644 --- a/app/_ai_gateway_policies/ai-prompt-compressor/index.md +++ b/app/_ai_gateway_policies/ai-prompt-compressor/index.md @@ -186,10 +186,7 @@ rows: {% endtable %} -## Headroom compressor service {% new_in 2.2 %} - -{:.warning} -> This feature is currently in [Tech Preview](/stages-of-software-availability/#tech-preview) and should not be used in a production environment. +## Headroom compressor service Before you use Headroom with the AI Prompt Compressor Policy, you need a Headroom instance accessible to your {{site.ai_gateway}}. @@ -209,10 +206,6 @@ data: name: my-ai-prompt-compressor type: ai-prompt-compressor config: - compression_ranges: - - min_tokens: 20 - max_tokens: 100 - value: 0.8 provider: headroom compressor_url: http://headroom-service:8787/v1/compress timeout: 45000 @@ -247,10 +240,18 @@ Headroom uses loopback-trust by default. It answers unauthenticated calls on `12 ### Headroom prompt flow -The AI Prompt Compressor Policy uses Headroom in a stateful mode and derives a session identifier for each conversation, based on the configured `config.headroom.session_id_headers`, an [AI Consumer](/ai-gateway/entities/ai-consumer/), or a `credential`. Headroom can recognize the turns it has already compressed for that conversation. Recognized turns are replayed unchanged instead of compressed again. This ensures the upstream LLM provider's cache hits on repeated turns. +The AI Prompt Compressor Policy uses Headroom in a stateful mode and derives a session identifier for each conversation, based on the configured `config.headroom.session_id_headers`, an [AI Consumer](/ai-gateway/entities/ai-consumer/), or a `credential`. Headroom can recognize the turns it has already compressed for that conversation. Recognized turns are replayed unchanged instead of compressed again. This ensures the upstream LLM provider's cache hits on repeated turns. If a session identifier isn't present, then every client that opens with the same prompt shares one session state on the Headroom side. If sessions collide, then only one will hit the upstream cache. +{% comment %} +Headroom compresses in one of two modes, set with `config.headroom.mode`. +The default, `lossy`, drops what Headroom deems redundant, without a way to recover it. +`ccr` ensures the original content is retrievable. +If the model needs to retrieve it, {{site.ai_gateway}} resolves that retrieval against the provider on the model's behalf. +Use `lossy` unless something downstream of the model depends on exact tool output or conversation history that was compressed away, since `ccr` adds a round trip and has narrower provider support. +{% endcomment %} + 1. {{site.ai_gateway}} sends the user or agent's request to the AI Prompt Compressor. 2. The AI Prompt Compressor builds a messages array from the whole conversation. 3. The AI Prompt Compressor sends a `POST` request to Headroom's `/v1/compress` endpoint with the messages array and a session identifier for the conversation. @@ -292,18 +293,191 @@ sequenceDiagram {% endmermaid %} +{% comment %} + +Set `config.headroom.mode` to `ccr` when something downstream of the model needs to retrieve the content Headroom compressed away. +In this mode, Headroom marks the content it compressed and adds a `headroom_retrieve` tool to the request instead of dropping that content. +If the model calls that tool, the AI Prompt Compressor Policy resolves the retrieval against the provider itself and returns only the final answer. +The client never sees the `headroom_retrieve` tool call. +`ccr` requires Headroom v0.38.0 or later. + +`ccr` costs more than `lossy` compression in exchange for that reversibility. +Each retrieval the model asks for is an extra round trip to the provider. That round trip is metered the same as any other provider call, in token analytics, cost, and rate limiting. + + +The following diagram illustrates how the AI Prompt Compressor Policy resolves a retrieval in `ccr` mode: + + +{% mermaid %} +sequenceDiagram + actor User as User/Agent + participant KongAICompressor as AI Prompt Compressor Policy + participant Headroom + participant LLM as LLM Provider + + User->>KongAICompressor: Sends request + activate KongAICompressor + KongAICompressor->>Headroom: POST /v1/compress with messages and session ID + Headroom-->>KongAICompressor: Return compressed messages, headroom_retrieve tool, and metadata + KongAICompressor->>LLM: Send compressed messages and headroom_retrieve tool + LLM-->>KongAICompressor: Calls headroom_retrieve for a compressed turn + + KongAICompressor->>LLM: Re-sends request with the original turn restored + LLM-->>KongAICompressor: Return final answer + KongAICompressor-->>User: Return final answer only + deactivate KongAICompressor +{% endmermaid %} + + +Headroom's `HEADROOM_GATEWAY_TURN_TTL_SECONDS` setting (120 seconds by default) must be longer than the slowest provider response the route serves. If a retrieval takes longer than that, Headroom drops the turn, and the model's request for the original content fails with an error instead of returning it. +{% endcomment %} + ### Failure handling By default, if the call to Headroom fails, times out, or returns an error, the Policy returns an HTTP `500` to the client rather than forwarding the request uncompressed. A `503` response indicating a compression timeout is retried automatically before the Policy gives up; every other non-`200` response (for example a `400` from a bad configuration, or a `401` from a missing or incorrect bearer token) fails immediately. +A call to Headroom that reuses a pooled connection Headroom has already closed is sent again on a new connection instead of failing the request. + ### Limitations - Deterministic compression requires sessions which is only available in **Headroom v0.37.0 or newer**. Older images silently ignore the session id and run stateless. - Headroom sessions are held in memory on a single Headroom process. You must point every data plane node at its own sidecar, or all of them at one shared instance. Never point an {{site.ai_gateway}} data plane at a load-balanced set of Headroom instances, since a session's turns must all reach the same process. - No MCP tool-response compression: only the LLM request path is supported. - Only requests with a `messages` or `input` conversation array are sent to Headroom. Other formats are forwarded uncompressed. +- A native Bedrock Converse request is skipped, with a warning. Headroom can't read Converse's content blocks. + +{% comment %} +- `ccr` mode doesn't support the OpenAI Responses API. A request in that format on a `ccr` route is compressed as `lossy` instead. +- For a streaming client in `ccr` mode, the AI Prompt Compressor Policy returns HTTP `200` and sends ping events once the request is 5 seconds old, before the provider has answered. If the provider then returns an error, the client receives it as an SSE `error` event rather than an HTTP error status, which changes how the client should retry. +- `ccr` only works where the AI Prompt Compressor Policy can read the provider's answer in the format Headroom compressed: Anthropic Messages requests to Claude (direct, or through Bedrock, Vertex, Azure, or Databricks), and OpenAI chat requests to OpenAI or Azure OpenAI. A request on a `ccr` route that doesn't match one of these is compressed `lossy` instead, with no extra configuration needed. +{% endcomment %} + +## Prompt compression metrics + + + +When a request passes through the AI Prompt Compressor Policy, {{site.ai_gateway}} reports the compression result to [Konnect Analytics](/observability/explorer/). You can use these metrics to measure how many tokens compression saves and how long it takes. + +Compression metrics are reported with the existing {{site.ai_gateway}} dimensions, so you can scope them by `ai_gateway`, `ai_gateway_data_plane_node`, and `control_plane`. The Policy configuration doesn't change, and the compression log entry (`compress_items`) keeps its fields and values. + +Compression metrics contain token and message counts only. They never include the original or compressed text. + +### Analytics metrics + +The following metrics are available in Explorer: + + +{% table %} +columns: + - title: Metric + key: metric + - title: Type + key: type + - title: Description + key: description +rows: + - metric: "`compression_saved_tokens`" + type: Count + description: Number of tokens saved, summed over the compressed messages. + - metric: "`compression_original_tokens`" + type: Count + description: Number of tokens before compression. + - metric: "`compression_compressed_tokens`" + type: Count + description: Number of tokens after compression. + - metric: "`compression_message_count`" + type: Count + description: Number of compressed messages per request. + - metric: "`compression_duration_average`" + type: Latency + description: Average time the compressor took, in milliseconds. +{% endtable %} + + +### Analytics dimensions + +You can also group and filter the compression metrics by these compression-specific dimensions: + + +{% table %} +columns: + - title: Dimension + key: dimension + - title: Values + key: values + - title: Description + key: description +rows: + - dimension: "`compressor_provider`" + values: "`kong`, `headroom`" + description: The compression provider that handled the request. + - dimension: "`compression_type`" + values: "`rate`, `target_token`" + description: The compression method used. Available for the `kong` provider only. For `headroom`, the value is empty. +{% endtable %} + + +The two providers report compression at different granularity. The `kong` provider reports one result for each compressed message. [Headroom](#headroom-compressor-service) reports one result for the whole request. The metrics sum the results for each request, so they mean the same thing for both providers. + +### Saved token counter + +{{site.ai_gateway}} also counts the tokens saved by compression for each provider and model, next to the AI request count. +{{site.ai_gateway}} records the count only for requests that save at least one token. + +{:.info} +> In a hybrid deployment, the control plane doesn't record the saved token count. Only the Konnect Analytics metrics report it. + +### Log fields + +The summary is also added to the `ai.compressor` entry of the log serializer, beside `compress_items`. Logging Policies such as HTTP Log and File Log include these fields: + + +{% table %} +columns: + - title: Field + key: field + - title: Description + key: description +rows: + - field: "`provider`" + description: The compression provider, `kong` or `headroom`. + - field: "`original_token_count`" + description: Number of tokens before compression. + - field: "`compress_token_count`" + description: Number of tokens after compression. + - field: "`save_token_count`" + description: Number of tokens saved. + - field: "`compressed_message_count`" + description: Number of compressed messages. + - field: "`duration`" + description: Time the compressor took, in milliseconds. + - field: "`compress_type`" + description: The compression method. Not set for `headroom`. +{% endtable %} + + +### Response headers + +When compression runs, the Policy adds the following headers to plain and streamed responses, so the caller can read what compression saved. The headers aren't added when the request isn't compressed, and they aren't forwarded to the upstream: + + +{% table %} +columns: + - title: Header + key: header + - title: Value + key: value +rows: + - header: "`X-Kong-Prompt-Compression-Saved-Tokens`" + value: Number of tokens saved. + - header: "`X-Kong-Prompt-Compression-Messages`" + value: Number of compressed messages. + - header: "`X-Kong-Prompt-Compression-Duration`" + value: Time the compressor took, in milliseconds. +{% endtable %} + ## Forward proxy support diff --git a/app/_ai_gateway_policies/opentelemetry/index.md b/app/_ai_gateway_policies/opentelemetry/index.md index 5f9aac83526..f1dfb54e095 100644 --- a/app/_ai_gateway_policies/opentelemetry/index.md +++ b/app/_ai_gateway_policies/opentelemetry/index.md @@ -64,6 +64,56 @@ You can add or override resource attributes by configuring the [`config.resource For all available metrics, see the [OpenTelemetry metrics reference](/ai-gateway/ai-otel-metrics/). +### Add Principal attributes to metrics + +Set [`config.metrics.enable_principal_attribute`](./reference/#schema--config-metrics-enable-principal-attribute) to `true` to attach the authenticated [Kong Identity Principal](/identity/principals/)'s ID and display name to the `http.server.request.count`, `http.server.request.size`, and `http.server.response.size` metrics. You can enable this at the same time as AI Consumer attributes. + +In the following example: +* [`config.metrics.enable_request_metrics`](./reference/#schema--config-metrics-enable-request-metrics) adds request count metrics. +* [`config.metrics.enable_bandwidth_metrics`](./reference/#schema--config-metrics-enable-bandwidth-metrics) adds request and response size metrics. +* `enable_principal_attribute` attaches the Principal attributes to whichever of those metrics are enabled. + +{% entity_example %} +type: policy +data: + display_name: OpenTelemetry - Principal Metrics + name: opentelemetry + type: opentelemetry + config: + metrics: + endpoint: http://localhost:4318/v1/metrics + push_interval: 10 + enable_request_metrics: true + enable_bandwidth_metrics: true + enable_principal_attribute: true +formats: + - konnect-api + - kongctl +{% endentity_example %} + +These attributes are added to the enabled metrics: + + +{% table %} +columns: + - title: Metric attribute + key: attribute + - title: Config + key: config + - title: Description + key: description +rows: + - attribute: "`kong.auth.principal.id`" + config: "[`enable_principal_attribute`](./reference/#schema--config-metrics-enable-principal-attribute)" + description: ID of the authenticated Principal managed by {{site.identity}}. + - attribute: "`kong.auth.principal.display_name`" + config: "[`enable_principal_attribute`](./reference/#schema--config-metrics-enable-principal-attribute)" + description: Display name of the authenticated Principal managed by {{site.identity}}. +{% endtable %} + + +If the request has no authenticated AI Consumer or Principal, the corresponding attribute is left empty on the exported metrics. + ## Tracing diff --git a/app/_ai_gateway_policies/rate-limiting-advanced/index.md b/app/_ai_gateway_policies/rate-limiting-advanced/index.md index eb2785d9bff..785b879700b 100644 --- a/app/_ai_gateway_policies/rate-limiting-advanced/index.md +++ b/app/_ai_gateway_policies/rate-limiting-advanced/index.md @@ -121,6 +121,107 @@ To key counters on a combination of values, set [`config.compound_identifier`](. {% include md/ai-gateway/v2/policies/rate-limiting/limit-by-ip.md %} +### AI Consumer counter key + +When [`config.identifier`](./reference/#schema--config-identifier) is `consumer`, use [`config.counter_key`](./reference/#schema--config-counter-key) to control which AI Consumer attribute keys the rate limit counter. By default, the counter is keyed by `consumer.id`. You can also key by `consumer.username` or `consumer.custom_id`. + +When you use `consumer.username` or `consumer.custom_id`, AI Consumers with identical attribute values contribute to the same rate limit counter, even if they were authenticated by different control planes. This enables consistent rate limiting across distributed deployments that share a Redis backend. + +`counter_key` also applies when using [`compound_identifier`](./reference/#schema--config-compound-identifier) with a Consumer segment, for example `["ip", "consumer"]`. + +{% entity_example %} +type: policy +data: + display_name: Rate Limiting Advanced - Consumer Username + name: rate-limiting-advanced-counter-key + type: rate-limiting-advanced + enabled: true + global: true + config: + identifier: consumer + counter_key: consumer.username + strategy: redis + redis: + host: ${redis_host} + port: 6379 + sync_rate: 10 + limit: + - 10 + window_size: + - 60 +variables: + redis_host: + value: $REDIS_HOST + description: The host where your Redis instance is running. +formats: + - kongctl + - konnect-api +{% endentity_example %} + +This example rate limits AI Consumers with the same username to a single shared counter, regardless of which control plane processed the request. + +### Rate limit by Principal + +Set [`config.identifier`](./reference/#schema--config-identifier) to `principal` to rate limit based on the authenticated [Kong Identity Principal](/identity/principals/) instead of the AI Consumer, credential, IP address, or other supported identifiers. `principal` is also a valid segment in [`config.compound_identifier`](./reference/#schema--config-compound-identifier). + +{% entity_example %} +type: policy +data: + display_name: Rate Limiting Advanced - Principal + name: rate-limiting-advanced-principal + type: rate-limiting-advanced + enabled: true + global: true + config: + identifier: principal + limit: + - 10 + window_size: + - 60 +formats: + - kongctl + - konnect-api +{% endentity_example %} + +`principal` requires an AI Auth Strategy that populates the Principal, for example, the `openid-connect` AI Auth Strategy configured with [Kong Identity Principal mapping](/ai-gateway/entities/ai-auth-strategy/#principal-mapping). + +[`config.custom_key`](./reference/#schema--config-custom-key) overrides the computed rate limiting key with a literal string, regardless of `identifier` or `compound_identifier`. This is most useful in combination with [expressible config fields](#dynamic-configuration-with-cel), where `custom_key`'s value comes from a CEL expression instead of a fixed string. + +### Dynamic configuration with CEL + +`limit` and `custom_key` accept a CEL expression. If an expression is set, {{site.ai_gateway}} evaluates it on each request and uses the result as the field’s value, for example an attribute of the authenticated AI Consumer or Principal. If the expression fails to evaluate, {{site.ai_gateway}} uses the static value in `config`. + +Because `limit` is an array field (one value per configured window), its expression is also an array, with one expression per element, in the same order: + +{% entity_example %} +type: policy +data: + display_name: Rate Limiting Advanced - Principal Metadata + name: rate-limiting-advanced-principal-metadata + type: rate-limiting-advanced + enabled: true + global: true + config: + identifier: principal + custom_key: unknown-partner + limit: + - 10 + window_size: + - 60 + expressions: + custom_key: principal.metadata.partner_id + limit: + - principal.metadata.rate_limit +formats: + - kongctl + - konnect-api +{% endentity_example %} + +In this example, `custom_key` and `limit` are static fallback values used only if the corresponding CEL expression is unset, invalid, or fails to evaluate. + +{:.info} +> **Note**: `window_size` is **not** expressible because it's unreliable. For the `cluster` and `redis` strategies, window sizes are registered for cross-node counter synchronization once, from the static config, when the Policy is configured. A per-request expression-driven window size would never be picked up by that registration. + ## Headers sent to the client {% include md/ai-gateway/v2/policies/rate-limiting/headers.md sliding_window=true %} diff --git a/app/_data/ai-gateway/v2/providers.yaml b/app/_data/ai-gateway/v2/providers.yaml index 7d56f277c4e..cf8909aa960 100644 --- a/app/_data/ai-gateway/v2/providers.yaml +++ b/app/_data/ai-gateway/v2/providers.yaml @@ -7,7 +7,7 @@ providers: generate: supported: true streaming: true - upstream_path: 'Uses the `Converse` and `ConverseStream` API' + upstream_path: "Uses the `Converse` and `ConverseStream` APIs. When a client sends an Anthropic-format request to an Anthropic Claude model, {{site.ai_gateway}} sends it to `InvokeModel` or `InvokeModelWithResponseStream` instead, because the request is already in Claude's native format." model_example: '[Use the model name for the specific LLM provider](https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html)' min_version: '2.0' completions: @@ -41,7 +41,7 @@ providers: model_example: 'n/a' min_version: '2.0' note: - content: 'Amazon Bedrock does not have a dedicated files API. File storage uses Google Cloud Storage, similar to AWS S3.' + content: 'Amazon Bedrock does not have a dedicated files API. Batch input and output files are stored in Amazon S3 and referenced by S3 URI.' image: supported: true streaming: false @@ -106,6 +106,24 @@ providers: statistics_logging: - 'Statistics logging is not available for image generation or editing APIs for Amazon Bedrock' + - name: Amazon Bedrock Mantle + url_patterns: + - 'https://bedrock-mantle.{region}.api.aws' + min_version: '2.3' + variant_trigger: 'set `endpoint_type: mantle` in the target `config` of your AI Model' + capabilities: + generate: + supported: true + streaming: true + upstream_path: '`/v1/chat/completions`, `/v1/responses`, and `/anthropic/v1/messages` (OpenAI and Anthropic formats, without translation)' + model_example: '[Use a model ID that Amazon Bedrock serves through the Mantle endpoint](https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html)' + min_version: '2.3' + limitations: + provider_specific: + - 'Mantle has no Converse or InvokeModel API, so Konnect rejects a target with `endpoint_type: mantle` if its AI Model declares a format with `type: bedrock`. Use the `openai` or `anthropic` format instead.' + - 'Mantle supports only chat and Responses requests. Embeddings and other capabilities are not supported. Use the `runtime` endpoint for them.' + statistics_logging: [] + - name: Anthropic url_patterns: - 'https://api.anthropic.com:443/{capability_path}' @@ -310,6 +328,98 @@ providers: statistics_logging: - 'No statistics logging for assistants, batch, or audio APIs' + - name: Baseten + url_patterns: + - 'https://inference.baseten.co/v1/{capability_path}' + - 'https://model-{model_id}.api.baseten.co/environments/{environment}/sync/v1/chat/completions' + min_version: '2.3' + capabilities: + generate: + supported: true + streaming: true + upstream_path: '`/v1/chat/completions`' + model_example: 'deepseek-ai/DeepSeek-V4-Pro-0813' + min_version: '2.3' + note: + content: 'Model APIs use the org-qualified model slug as the target `name`. For a dedicated deployment, set the target `upstream_url` to the deployment endpoint.' + completions: + supported: false + streaming: false + model_example: '' + min_version: '' + embeddings: + supported: false + streaming: false + model_example: '' + min_version: '' + files: + supported: false + streaming: false + model_example: '' + min_version: '' + batches: + supported: false + streaming: false + model_example: '' + min_version: '' + skills: + supported: false + streaming: false + model_example: '' + min_version: '' + agentic: + supported: false + streaming: false + model_example: '' + min_version: '' + audio_speech: + supported: false + streaming: false + model_example: '' + min_version: '' + audio_transcription: + supported: false + streaming: false + model_example: '' + min_version: '' + audio_translation: + supported: false + streaming: false + model_example: '' + min_version: '' + image: + supported: false + streaming: false + model_example: '' + min_version: '' + video: + supported: false + streaming: false + model_example: '' + min_version: '' + realtime: + supported: false + streaming: false + model_example: '' + min_version: '' + rerank: + supported: false + streaming: false + model_example: '' + min_version: '' + decisions: + supported: false + streaming: false + model_example: '' + min_version: '' + limitations: + general: + - "The Baseten provider proxies chat completions only. It doesn't support Baseten's Anthropic-compatible `/v1/messages` endpoint, embeddings, or the `/predict` and async inference APIs." + - "Baseten rejects some OpenAI request parameters. `audio`, `modalities`, `prediction`, `web_search_options`, and `n` greater than 1 return a 400 error, `service_tier` returns a 500 error, and the deprecated `function_call` and `functions` return a 501 error." + - "Baseten accepts but ignores `logprobs`, `top_logprobs`, `user`, `store`, `metadata`, `verbosity`, `safety_identifier`, and the explicit prompt cache controls. Baseten caches prompts automatically." + provider_specific: [] + statistics_logging: [] + - name: Cerebras url_patterns: - 'https://api.cerebras.ai/{capability_path}' @@ -688,7 +798,7 @@ providers: url_patterns: - 'https://aiplatform.googleapis.com/' min_version: '2.0' - variant_trigger: 'Setting `config.gcp_environment` (with `api_endpoint`, `location_id`, and `project_id`) on the AI Model''s target.' + variant_trigger: 'Setting `config.gcp_environment` (with `location_id` and `project_id`) on the AI Model''s target. The variant can also be detected from the request; see [Select Gemini Standard or Gemini Enterprise](#select-gemini-standard-or-gemini-enterprise).' capabilities: generate: supported: true @@ -715,7 +825,7 @@ providers: model_example: 'n/a' min_version: '2.0' note: - content: 'Gemini Enterprise does not have a dedicated Files API. File storage uses Google Cloud Storage, similar to AWS S3.' + content: 'Gemini Enterprise does not have a dedicated Files API. File storage uses Google Cloud Storage, similar to Amazon S3.' batches: supported: true streaming: false diff --git a/app/_how-tos/ai-gateway/configure-dynamic-plugin-config-with-cel.md b/app/_how-tos/ai-gateway/configure-dynamic-plugin-config-with-cel.md new file mode 100644 index 00000000000..196664c1703 --- /dev/null +++ b/app/_how-tos/ai-gateway/configure-dynamic-plugin-config-with-cel.md @@ -0,0 +1,273 @@ +--- +title: Configure dynamic Policy config with CEL in {{site.ai_gateway}} +permalink: /ai-gateway/configure-dynamic-plugin-config-with-cel/ +content_type: how_to + +description: Learn how to set a Rate Limiting Advanced Policy's rate limit and rate limiting key per request, based on the authenticated Principal's metadata. +products: + - ai-gateway + - identity + +works_on: + - konnect + +entities: + - ai-auth-strategy + - ai-model-provider + - ai-model + - principal + +tags: + - ai + - traffic-control + - authentication + +tools: + - kongctl + +min_version: + ai-gateway: '2.3' + +tldr: + q: How do I compute an AI Policy's config from a CEL expression instead of a fixed value? + a: | + To compute a Policy's config from a CEL expression instead of a fixed value, set a config field's parallel `expressions.FIELD` entry to a CEL expression, alongside the field's ordinary static `config.FIELD` value. + {{site.ai_gateway}} evaluates the expression per request. + If it succeeds, its result overrides the field for that request; if it fails, {{site.ai_gateway}} falls back to the static `config` value. + + This guide computes the Rate Limiting Advanced Policy's `limit` and `custom_key` fields from a Principal's metadata, so each authenticated caller gets their own rate limit and their own counter from a single Policy instance. + +faqs: + - q: What happens if a Principal is missing the metadata that an expression expects to find? + a: | + If the Principal is missing expected metadata, the expression fails to evaluate, and {{site.ai_gateway}} falls back to the field's static `config` value for that request. + {{site.ai_gateway}} doesn't raise an error, and the Policy still runs normally. + +prereqs: + inline: + - title: OpenAI API key + include_content: md/ai-gateway/v2/prereqs/openai-kongctl + icon_url: /assets/icons/openai.svg + - title: Kong Identity directory + include_content: prereqs/kong-identity-directory + icon_url: /assets/icons/identity.svg + +cleanup: + inline: + - title: Clean up {{site.ai_gateway}} resources + include_content: cleanup/products/ai-gateway + +related_resources: + - text: Configure dynamic plugin config with CEL in {{site.base_gateway}} + url: /gateway/configure-dynamic-plugin-config-with-cel/ + - text: Rate Limiting Advanced Policy + url: /ai-gateway/policies/rate-limiting-advanced/ + - text: AI Auth Strategy entity + url: /ai-gateway/entities/ai-auth-strategy/ +--- + +## Create a Principal + +An AI Policy's config can be computed per request from a [CEL expression](/ai-gateway/conditions/), for example, reading an attribute of the authenticated AI Consumer or Principal, instead of always using a fixed value. +In this guide, you'll create a [Principal](/identity/principals/) so that a custom limit can be applied to authenticated Principals. +{% include /how-tos/steps/principal.md %} + +Set the `rate_limit` and `partner_id` metadata fields on the Principal so the Policy expressions can reference them: + + +{% konnect_api_request %} +url: /v2/directories/$DIRECTORY_ID/principals/$PRINCIPAL_ID +status_code: 200 +method: PUT +body: + display_name: "example-principal" + description: "Example principal" + metadata: + rate_limit: 20 + partner_id: acme-rockets +{% endkonnect_api_request %} + + +## Add key auth + +Add an API key credential to the Principal so clients can authenticate with {{site.ai_gateway}} using key authentication. + +The following example sets a system-generated key (`v1`) and stores the key secret as `$KEY_SECRET`: + + +{% konnect_api_request %} +url: /v2/directories/$DIRECTORY_ID/principals/$PRINCIPAL_ID/api-keys +status_code: 201 +method: POST +body: + type: v1 +extract_body: + - name: 'secret' + variable: KEY_SECRET +capture: + - variable: KEY_SECRET + jq: ".secret" +{% endkonnect_api_request %} + + +## Get the directory name + +{% include /how-tos/steps/get-directory-name.md %} + +## Create an AI Auth Strategy, AI Model Provider, Policy, and AI Model + +Create a `key-auth` [AI Auth Strategy](/ai-gateway/entities/ai-auth-strategy/) with [Kong Identity Principal mapping](/ai-gateway/entities/ai-auth-strategy/#principal-mapping) enabled, so clients authenticate with the API key but {{site.ai_gateway}} resolves them to the Principal created earlier. +Principal mapping is mutually exclusive with `identity_realms`, so the strategy sets `identity_realms` to an empty list. +Also create an [AI Model Provider](/ai-gateway/entities/ai-model-provider/) for OpenAI and a [Rate Limiting Advanced Policy](/ai-gateway/policies/rate-limiting-advanced/) with CEL expressions. +Then create an [AI Model](/ai-gateway/entities/ai-model/) that references both the AI Auth Strategy and the Policy. + +`limit` and `custom_key` are expressible config fields on the Rate Limiting Advanced Policy. They both have parallel entries under `expressions`, alongside their static `config` values: + +* `identifier: principal`, so the Policy keys and limits by the authenticated Principal. +* A static `config.limit` and `config.custom_key`, used as the fallback whenever a request's expressions can't be evaluated. +* `expressions.limit` and `expressions.custom_key`, reading the authenticated Principal's `rate_limit` and `partner_id` metadata. + + +{% entity_examples %} +ai_gateway_auth_strategies: + - ref: identity-principal + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + display_name: "Identity Principal" + name: identity-principal + type: key-auth + config: + identity_realms: [] + principals: + enabled: true + directory: $DECK_DIRECTORY_NAME +ai_gateway_model_providers: + - ref: generic-openai + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + name: generic-openai + display_name: "generic-openai" + type: openai + config: + auth: + type: basic + headers: + - name: Authorization + value: !secret {source: !env OPENAI_AUTH_HEADER} +ai_gateway_policies: + - ref: rate-limit-by-principal + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + name: rate-limit-by-principal + display_name: "Rate Limiting Advanced - Principal Metadata" + type: rate-limiting-advanced + config: + identifier: principal + custom_key: unknown-partner + limit: + - 10 + window_size: + - 60 + strategy: local + expressions: + custom_key: principal.metadata.partner_id + limit: + - principal.metadata.rate_limit +ai_gateway_models: + - ref: my-gpt-4o-mini + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + display_name: my-gpt-4o-mini + name: my-gpt-4o-mini + type: model + enabled: true + formats: [{ type: openai }] + access: + auth_strategies: + - !ref identity-principal#name + policies: + - !ref rate-limit-by-principal#name + config: + route: + paths: + - / + model: + body_param: model + values: + - my-gpt-4o-mini + capabilities: [generate] + targets: + - name: gpt-4o-mini + provider: generic-openai + config: + type: openai +formats: + - kongctl +{% endentity_examples %} + + +## Validate + +Send a request with the API key stored in `$KEY_SECRET`: + +{% validation request-check %} +url: /chat/completions +method: POST +display_headers: true +headers: + - "apikey: $KEY_SECRET" + - 'Content-Type: application/json' +body: + model: my-gpt-4o-mini + messages: + - role: user + content: What is the capital of France? +status_code: 200 +{% endvalidation %} + +Check the `RateLimit-Limit` response header: + +``` +RateLimit-Limit: 20 +``` +{:.no-copy-code} + +The limit is now `20`, which `expressions.limit` reads from the Principal's `rate_limit` metadata, instead of the static fallback value of `10` from `config.limit`. + +To see the static fallback take over, remove the Principal's `rate_limit` metadata: + + +{% konnect_api_request %} +url: /v2/directories/$DIRECTORY_ID/principals/$PRINCIPAL_ID +status_code: 200 +method: PUT +body: + display_name: "example-principal" + description: "Example principal" + metadata: + partner_id: acme-rockets +{% endkonnect_api_request %} + + +{:.warning} +> {{site.ai_gateway}} caches a successfully authenticated Principal for the directory's configured `ttl_secs` (5 minutes at minimum, 10 minutes by default). Wait at least 5 minutes after the previous request before continuing, or the next request will still show the cached Principal's old metadata. + +After the `ttl` has elapsed (5-10 minutes), send another request: + +{% validation request-check %} +url: /chat/completions +method: POST +display_headers: true +headers: + - "apikey: $KEY_SECRET" + - 'Content-Type: application/json' +body: + model: my-gpt-4o-mini + messages: + - role: user + content: What is the capital of France? +status_code: 200 +{% endvalidation %} + +With `rate_limit` no longer present on the Principal, `expressions.limit` fails to evaluate, and {{site.ai_gateway}} falls back to the static `config.limit` value of `10`: + +``` +RateLimit-Limit: 10 +``` +{:.no-copy-code} diff --git a/app/_how-tos/ai-gateway/connect-to-bedrock-through-vpc-endpoint.md b/app/_how-tos/ai-gateway/connect-to-bedrock-through-vpc-endpoint.md new file mode 100644 index 00000000000..4a19f88b8db --- /dev/null +++ b/app/_how-tos/ai-gateway/connect-to-bedrock-through-vpc-endpoint.md @@ -0,0 +1,148 @@ +--- +title: Connect to Amazon Bedrock through a VPC endpoint with {{site.ai_gateway}} +content_type: how_to +permalink: /ai-gateway/connect-to-bedrock-through-vpc-endpoint/ + +related_resources: + - text: Amazon Bedrock provider + url: /ai-gateway/ai-providers/bedrock/ + - text: AI Model Provider entity + url: /ai-gateway/entities/ai-model-provider/ + - text: AI Model entity + url: /ai-gateway/entities/ai-model/ + - text: Route OpenAI traffic to Amazon Bedrock Mantle + url: /ai-gateway/route-openai-traffic-to-bedrock-mantle/ + +description: Send Amazon Bedrock traffic from {{site.ai_gateway}} through an AWS PrivateLink interface VPC endpoint while keeping Bedrock paths, streaming, and SigV4 signing intact. + +products: + - ai-gateway + +works_on: + - konnect + +tools: + - kongctl + +min_version: + ai-gateway: '2.3' + +tags: + - ai + - bedrock + +tldr: + q: How do I route {{site.ai_gateway}} traffic to Amazon Bedrock over AWS PrivateLink? + a: Set `vpc_endpoint` in the Bedrock target `config` of your AI Model to the DNS name of your Bedrock Runtime interface VPC endpoint. {{site.ai_gateway}} connects to that host, keeps building the Bedrock path for each operation, and signs requests with SigV4 for the real Bedrock service and region. + +prereqs: + inline: + - title: Amazon Bedrock VPC endpoint + content: | + 1. Create an interface VPC endpoint for the Bedrock Runtime service (`com.amazonaws..bedrock-runtime`) in the VPC where your data plane nodes run. See [Use interface VPC endpoints (AWS PrivateLink)](https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html) in the AWS documentation. + 1. Make sure your data plane nodes can resolve the endpoint's DNS name and reach it on port 443. + 1. Make sure your IAM user or role has `bedrock:Converse` and `bedrock:ConverseStream` permissions, and that the VPC endpoint policy allows them. + 1. Export your AWS credentials, region, and the endpoint DNS name: + ```bash + export AWS_ACCESS_KEY_ID='YOUR_AWS_ACCESS_KEY_ID' + export AWS_SECRET_ACCESS_KEY='YOUR_AWS_SECRET_ACCESS_KEY' + export AWS_REGION='YOUR_AWS_REGION' + export BEDROCK_VPC_ENDPOINT='YOUR_VPC_ENDPOINT_DNS_NAME' + ``` +cleanup: + inline: + - title: Clean up {{site.ai_gateway}} resources + include_content: cleanup/products/ai-gateway + +--- + +{% comment %} +TODO(reviewer, AI-125): +- Confirm the value format for `vpc_endpoint` (bare hostname vs. URL with scheme) and update the prereq export and example. +- Confirm which data plane deployments can use this (self-managed hybrid only, or also Dedicated Cloud Gateways with private networking). +- Q1: Confirm the `vpc_endpoint` + `upstream_url` behavior (precedence or validation error). +{% endcomment %} + +## Create an AI Model Provider + +You can configure {{site.ai_gateway}} to send Amazon Bedrock traffic from {{site.ai_gateway}} through an AWS PrivateLink interface VPC endpoint while keeping Bedrock paths, streaming, and SigV4 signing intact. +Create a `bedrock` type [AI Model Provider](/ai-gateway/entities/ai-model-provider/) that stores your AWS credentials: + +{% entity_examples %} +ai_gateway_model_providers: + - ref: my-aws-account + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + name: my-aws-account + display_name: "AWS Production" + type: bedrock + config: + auth: + type: aws + access_key_id: !env AWS_ACCESS_KEY_ID + secret_access_key: !secret {source: !env AWS_SECRET_ACCESS_KEY} +{% endentity_examples %} + +## Create an AI Model that uses the VPC endpoint + +Create an [AI Model](/ai-gateway/entities/ai-model/) with a Bedrock target that sets `vpc_endpoint`: + +{% entity_examples %} +ai_gateway_models: + - ref: my-private-bedrock-model + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + name: my-private-bedrock-model + display_name: "my-private-bedrock-model" + type: model + formats: + - type: openai + config: + route: + paths: + - /v1 + model: + body_param: model + values: + - my-private-bedrock-model + targets: + - name: us.anthropic.claude-haiku-4-5-20251001-v1:0 + provider: my-aws-account + config: + type: bedrock + region: !env AWS_REGION + vpc_endpoint: !env BEDROCK_VPC_ENDPOINT + capabilities: + - generate +{% endentity_examples %} + +The target uses the following settings: + +* `vpc_endpoint`: Replaces only the host that {{site.ai_gateway}} connects to. {{site.ai_gateway}} still builds the Bedrock path for each operation, including streaming, and SigV4 still signs for the Bedrock service in `region`. +* `region`: Sets the region used for SigV4 signing. It must match the region of the VPC endpoint. + +Leave `upstream_url` unset on this target. If both are set, `upstream_url` takes precedence and replaces the full URL, including the path. + +If your AI Model also uses Bedrock embeddings, set `vpc_endpoint` in [`config.balancer.embeddings`](/ai-gateway/entities/ai-model/#schema-aigateway-model-config-balancer-embeddings) as well. + +## Validate + +Send a streaming chat request to the AI Model: + + +{% validation request-check %} +url: /v1/chat/completions +status_code: 200 +method: POST +retry: true +headers: + - 'Accept: application/json' + - 'Content-Type: application/json' +body: + messages: + - role: "user" + content: "Say this is a test!" + model: my-private-bedrock-model + stream: true +{% endvalidation %} + + +A `200` response with streamed chunks confirms that {{site.ai_gateway}} reached Bedrock through the VPC endpoint and built the streaming path. If the request fails with a connection error, check that your data plane nodes can resolve and reach the VPC endpoint. {{site.ai_gateway}} doesn't fall back to the public Bedrock endpoint. diff --git a/app/_how-tos/ai-gateway/route-openai-traffic-to-bedrock-mantle.md b/app/_how-tos/ai-gateway/route-openai-traffic-to-bedrock-mantle.md new file mode 100644 index 00000000000..7dadad43ea7 --- /dev/null +++ b/app/_how-tos/ai-gateway/route-openai-traffic-to-bedrock-mantle.md @@ -0,0 +1,143 @@ +--- +title: Route OpenAI traffic to Amazon Bedrock Mantle with {{site.ai_gateway}} +content_type: how_to +permalink: /ai-gateway/route-openai-traffic-to-bedrock-mantle/ + +related_resources: + - text: Amazon Bedrock provider + url: /ai-gateway/ai-providers/bedrock/ + - text: AI Model Provider entity + url: /ai-gateway/entities/ai-model-provider/ + - text: AI Model entity + url: /ai-gateway/entities/ai-model/ + - text: Connect to Amazon Bedrock through a VPC endpoint + url: /ai-gateway/connect-to-bedrock-through-vpc-endpoint/ + +description: Configure an AI Model that sends OpenAI Chat Completions requests to the Amazon Bedrock Mantle endpoint without translating them. + +products: + - ai-gateway + +works_on: + - konnect + +tools: + - kongctl + +min_version: + ai-gateway: '2.3' + +tags: + - ai + - bedrock + +tldr: + q: How do I send OpenAI-format requests to Amazon Bedrock Mantle through {{site.ai_gateway}}? + a: Create an AI Model Provider of type `bedrock` with your AWS credentials, then create an AI Model with the `openai` format and a Bedrock target that sets `endpoint_type` to `mantle`. {{site.ai_gateway}} sends OpenAI requests to `bedrock-mantle.{region}.api.aws` in OpenAI format, without translating them to Bedrock Converse, and signs them with SigV4. + +prereqs: + inline: + - title: Amazon Bedrock Mantle + content: | + 1. In the AWS Management Console, confirm that Amazon Bedrock Mantle is available in your region and that your account has access to the model you want to use. + 1. Create an IAM user or role with permission to call Bedrock Mantle, then create access keys for it. + 1. Export your AWS credentials, region, and the Mantle model ID: + ```bash + export AWS_ACCESS_KEY_ID='YOUR_AWS_ACCESS_KEY_ID' + export AWS_SECRET_ACCESS_KEY='YOUR_AWS_SECRET_ACCESS_KEY' + export AWS_REGION='YOUR_AWS_REGION' + export MANTLE_MODEL_ID='YOUR_MANTLE_MODEL_ID' + ``` +cleanup: + inline: + - title: Clean up {{site.ai_gateway}} resources + include_content: cleanup/products/ai-gateway + +--- + +{% comment %} +TODO(reviewer, AI-123): +- Name the exact IAM actions Mantle requires (prereqs step 2) and link the AWS Mantle docs. +- Pick a concrete Mantle model ID and region for this guide so the validation step can run in CI. +{% endcomment %} + +## Create an AI Model Provider + +Create a `bedrock` type [AI Model Provider](/ai-gateway/entities/ai-model-provider/) that stores your AWS credentials. The same provider works for Bedrock Runtime and Bedrock Mantle targets: + +{% entity_examples %} +ai_gateway_model_providers: + - ref: my-aws-account + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + name: my-aws-account + display_name: "AWS Production" + type: bedrock + config: + auth: + type: aws + access_key_id: !env AWS_ACCESS_KEY_ID + secret_access_key: !secret {source: !env AWS_SECRET_ACCESS_KEY} +{% endentity_examples %} + +To authenticate with an Amazon Bedrock API key instead of SigV4, set [`config.auth.type`](/ai-gateway/entities/ai-model-provider/#schema-aigateway-model-provider-config-auth) to `basic` and add an `Authorization` header with the value `Bearer ` in `config.auth.headers`. + +## Create an AI Model with a Mantle target + +Create an [AI Model](/ai-gateway/entities/ai-model/) that accepts OpenAI requests and routes them to Bedrock Mantle: + +{% entity_examples %} +ai_gateway_models: + - ref: my-mantle-model + ai_gateway: !lookup {id: !env AI_GATEWAY_ID} + name: my-mantle-model + display_name: "my-mantle-model" + type: model + formats: + - type: openai + config: + route: + paths: + - /v1 + model: + body_param: model + values: + - my-mantle-model + targets: + - name: !env MANTLE_MODEL_ID + provider: my-aws-account + config: + type: bedrock + region: !env AWS_REGION + endpoint_type: mantle + capabilities: + - generate +{% endentity_examples %} + +The AI Model uses the following settings: + +* `formats: [type: openai]`: Accepts OpenAI Chat Completions requests. A Mantle target can't be paired with the `bedrock` format, because Mantle has no Converse or InvokeModel API, and {{site.konnect_short_name}} rejects that configuration. +* `targets[].config.endpoint_type: mantle`: Sends requests to `https://bedrock-mantle.{region}.api.aws` instead of the default Bedrock Runtime endpoint. {{site.ai_gateway}} keeps the OpenAI request format instead of translating it to Bedrock Converse, and changes only the host, path, and authentication headers. +* `config.route.model`: Lets clients send the alias `my-mantle-model` in the `model` field instead of the upstream model ID. + +## Validate + +Send a chat request to the AI Model: + + +{% validation request-check %} +url: /v1/chat/completions +status_code: 200 +method: POST +retry: true +headers: + - 'Accept: application/json' + - 'Content-Type: application/json' +body: + messages: + - role: "user" + content: "Say this is a test!" + model: my-mantle-model +{% endvalidation %} + + +A `200` response with an OpenAI Chat Completions body confirms that Bedrock Mantle served the request. diff --git a/app/_how-tos/ai-gateway/use-kafka-consume-policy.md b/app/_how-tos/ai-gateway/use-kafka-consume-policy.md index 224286569fd..784febcc365 100644 --- a/app/_how-tos/ai-gateway/use-kafka-consume-policy.md +++ b/app/_how-tos/ai-gateway/use-kafka-consume-policy.md @@ -59,8 +59,9 @@ cleanup: - title: Stop the Kafka broker content: | ```sh - docker compose down + docker compose -f kafka-consume-test/docker-compose.yaml down ``` + {: data-test-cleanup="block" } - title: Clean up {{site.ai_gateway}} resources include_content: cleanup/products/ai-gateway --- @@ -70,9 +71,9 @@ cleanup: Create a working directory and a JAAS file that defines the SASL/PLAIN user for the broker: ```sh -mkdir -p ~/kafka-consume-test && cd ~/kafka-consume-test +mkdir -p kafka-consume-test -cat <<'EOF' > kafka_server_jaas.conf +cat <<'EOF' > kafka-consume-test/kafka_server_jaas.conf KafkaServer { org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka_user" @@ -81,6 +82,7 @@ KafkaServer { }; EOF ``` +{: data-test-step="block" } ## Start a Kafka broker @@ -90,7 +92,7 @@ Run a single-node KRaft broker with two listeners: * Plaintext on port `9094`, advertised as `localhost`. Local tooling connects to this listener, because `host.docker.internal` doesn't resolve from the host itself. ```sh -cat <<'EOF' > docker-compose.yaml +cat <<'EOF' > kafka-consume-test/docker-compose.yaml name: kafka_aigw services: @@ -120,27 +122,33 @@ services: - ./kafka_server_jaas.conf:/etc/kafka/kafka_server_jaas.conf EOF -docker compose up -d +docker compose -f kafka-consume-test/docker-compose.yaml up -d ``` +{: data-test-step="block" } ## Verify SASL authentication Run the SASL check from a separate container so it uses the same network path as the data plane: -```sh -cat <<'EOF' > client.properties -security.protocol=SASL_PLAINTEXT -sasl.mechanism=PLAIN -sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka_user" password="kafka-password"; -EOF - -docker run --rm \ - -v "$PWD/client.properties:/tmp/client.properties" \ - apache/kafka:4.3.1 \ - /opt/kafka/bin/kafka-broker-api-versions.sh \ - --bootstrap-server host.docker.internal:9092 \ - --command-config /tmp/client.properties -``` +{% validation custom-command %} +command: | + cat <<'EOF' > kafka-consume-test/client.properties + security.protocol=SASL_PLAINTEXT + sasl.mechanism=PLAIN + sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka_user" password="kafka-password"; + EOF + + docker run --rm \ + -v "$PWD/kafka-consume-test/client.properties:/tmp/client.properties" \ + apache/kafka:4.3.1 \ + /opt/kafka/bin/kafka-broker-api-versions.sh \ + --bootstrap-server host.docker.internal:9092 \ + --command-config /tmp/client.properties +expected: + return_code: 0 + message: 'SaslHandshake(17)' +render_output: false +{% endvalidation %} The output lists the broker API versions, including `SaslHandshake(17)` and `SaslAuthenticate(36)`, without a `SaslAuthenticationException`. @@ -148,22 +156,32 @@ The output lists the broker API versions, including `SaslHandshake(17)` and `Sas Create a `kafkactl` context that connects through the plaintext listener, then create the `ai-events` and `ai-audit` topics: -```sh -cat <<'EOF' > kafkactl.yaml -contexts: - direct: - brokers: - - localhost:9094 -EOF - -kafkactl -C kafkactl.yaml --context direct create topic ai-events -``` +{% validation custom-command %} +command: | + cat <<'EOF' > kafka-consume-test/kafkactl.yaml + contexts: + direct: + brokers: + - localhost:9094 + EOF + + kafkactl -C kafka-consume-test/kafkactl.yaml --context direct create topic ai-events +expected: + return_code: 0 + message: 'topic created: ai-events' +render_output: false +{% endvalidation %} Create the second topic: -```sh -kafkactl -C kafkactl.yaml --context direct create topic ai-audit -``` +{% validation custom-command %} +command: | + kafkactl -C kafka-consume-test/kafkactl.yaml --context direct create topic ai-audit +expected: + return_code: 0 + message: 'topic created: ai-audit' +render_output: false +{% endvalidation %} ## Create a Kafka Consume Policy and an AI Agent @@ -173,7 +191,7 @@ This example sets `security.ssl` to `false` so the test setup doesn't need certi We don't recommend this in production because the traffic isn't encrypted. ```sh -cat <<'EOF' > kafka-consume.yaml +cat <<'EOF' > kafka-consume-test/kafka-consume.yaml _defaults: kongctl: namespace: kafka-test @@ -226,8 +244,9 @@ ai_gateway_agents: strip_path: true EOF -kongctl sync -f kafka-consume.yaml --pat "$KONNECT_TOKEN" +kongctl sync -f kafka-consume-test/kafka-consume.yaml --auto-approve --pat "$KONNECT_TOKEN" ``` +{: data-test-step="block" } ## Validate @@ -237,27 +256,47 @@ The Policy uses `auto_offset_reset: latest`, so the consumer starts at the end o Requests sent before the data plane picks up the new configuration return `404`, so wait a few seconds after `kongctl sync`. The response contains no records yet: - ```sh - curl -s "$KONNECT_PROXY_URL/kafka" | jq . - ``` +{% validation request-check %} +url: /kafka +status_code: 200 +indent: 3 +{% endvalidation %} 1. Produce a message to the `ai-events` topic: - ```sh - kafkactl -C kafkactl.yaml --context direct produce ai-events --value='{"event":"prompt_received","model":"gpt-4o"}' - ``` +{% validation custom-command %} +command: | + kafkactl -C kafka-consume-test/kafkactl.yaml --context direct produce ai-events --value='{"event":"prompt_received","model":"gpt-4o"}' +expected: + return_code: 0 + message: 'message produced' +render_output: false +indent: 3 +{% endvalidation %} 1. Produce a message to the `ai-audit` topic: - ```sh - kafkactl -C kafkactl.yaml --context direct produce ai-audit --value='{"actor":"user","action":"policy_applied"}' - ``` +{% validation custom-command %} +command: | + kafkactl -C kafka-consume-test/kafkactl.yaml --context direct produce ai-audit --value='{"actor":"user","action":"policy_applied"}' +expected: + return_code: 0 + message: 'message produced' +render_output: false +indent: 3 +{% endvalidation %} 1. Send a second request to read the messages: - ```sh - curl -s "$KONNECT_PROXY_URL/kafka" | jq . - ``` +{% validation custom-command %} +command: | + curl -s "$KONNECT_PROXY_URL/kafka" | jq . +expected: + return_code: 0 + message: '"prompt_received"' +render_output: false +indent: 3 +{% endvalidation %} The response groups records by topic name, then by partition: diff --git a/app/_how-tos/ai-gateway/use-kafka-upstream-policy.md b/app/_how-tos/ai-gateway/use-kafka-upstream-policy.md index 8ba22628ade..8b02eddea36 100644 --- a/app/_how-tos/ai-gateway/use-kafka-upstream-policy.md +++ b/app/_how-tos/ai-gateway/use-kafka-upstream-policy.md @@ -57,8 +57,9 @@ cleanup: - title: Stop the Kafka broker content: | ```sh - docker compose down + docker compose -f kafka-upstream-test/docker-compose.yaml down ``` + {: data-test-cleanup="block" } - title: Clean up {{site.ai_gateway}} resources include_content: cleanup/products/ai-gateway --- @@ -68,9 +69,9 @@ cleanup: Create a working directory and a JAAS file that defines the SASL/PLAIN user for the broker: ```sh -mkdir -p ~/kafka-upstream-test && cd ~/kafka-upstream-test +mkdir -p kafka-upstream-test -cat <<'EOF' > kafka_server_jaas.conf +cat <<'EOF' > kafka-upstream-test/kafka_server_jaas.conf KafkaServer { org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka_user" @@ -79,6 +80,7 @@ KafkaServer { }; EOF ``` +{: data-test-step="block" } ## Start a Kafka broker @@ -88,7 +90,7 @@ Run a single-node KRaft broker with two listeners: * Plaintext on port `9094`, advertised as `localhost`. Local tooling connects to this listener, because `host.docker.internal` doesn't resolve from the host itself. ```sh -cat <<'EOF' > docker-compose.yaml +cat <<'EOF' > kafka-upstream-test/docker-compose.yaml name: kafka_aigw services: @@ -118,27 +120,33 @@ services: - ./kafka_server_jaas.conf:/etc/kafka/kafka_server_jaas.conf EOF -docker compose up -d +docker compose -f kafka-upstream-test/docker-compose.yaml up -d ``` +{: data-test-step="block" } ## Verify SASL authentication Run the SASL check from a separate container so it uses the same network path as the data plane: -```sh -cat <<'EOF' > client.properties -security.protocol=SASL_PLAINTEXT -sasl.mechanism=PLAIN -sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka_user" password="kafka-password"; -EOF - -docker run --rm \ - -v "$PWD/client.properties:/tmp/client.properties" \ - apache/kafka:4.3.1 \ - /opt/kafka/bin/kafka-broker-api-versions.sh \ - --bootstrap-server host.docker.internal:9092 \ - --command-config /tmp/client.properties -``` +{% validation custom-command %} +command: | + cat <<'EOF' > kafka-upstream-test/client.properties + security.protocol=SASL_PLAINTEXT + sasl.mechanism=PLAIN + sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka_user" password="kafka-password"; + EOF + + docker run --rm \ + -v "$PWD/kafka-upstream-test/client.properties:/tmp/client.properties" \ + apache/kafka:4.3.1 \ + /opt/kafka/bin/kafka-broker-api-versions.sh \ + --bootstrap-server host.docker.internal:9092 \ + --command-config /tmp/client.properties +expected: + return_code: 0 + message: 'SaslHandshake(17)' +render_output: false +{% endvalidation %} The output lists the broker API versions, including `SaslHandshake(17)` and `SaslAuthenticate(36)`, without a `SaslAuthenticationException`. @@ -146,16 +154,21 @@ The output lists the broker API versions, including `SaslHandshake(17)` and `Sas Create a `kafkactl` context that connects through the plaintext listener, then create the `kong-upstream` topic: -```sh -cat <<'EOF' > kafkactl.yaml -contexts: - direct: - brokers: - - localhost:9094 -EOF - -kafkactl -C kafkactl.yaml --context direct create topic kong-upstream -``` +{% validation custom-command %} +command: | + cat <<'EOF' > kafka-upstream-test/kafkactl.yaml + contexts: + direct: + brokers: + - localhost:9094 + EOF + + kafkactl -C kafka-upstream-test/kafkactl.yaml --context direct create topic kong-upstream +expected: + return_code: 0 + message: 'topic created: kong-upstream' +render_output: false +{% endvalidation %} ## Create a Kafka Upstream Policy and an AI Agent @@ -166,7 +179,7 @@ This example sets `security.ssl` to `false` so the test setup doesn't need certi We don't recommend this in production because the traffic isn't encrypted. ```sh -cat <<'EOF' > kafka-upstream.yaml +cat <<'EOF' > kafka-upstream-test/kafka-upstream.yaml _defaults: kongctl: namespace: kafka-upstream-test @@ -218,8 +231,9 @@ ai_gateway_agents: strip_path: true EOF -kongctl sync -f kafka-upstream.yaml --pat "$KONNECT_TOKEN" +kongctl sync -f kafka-upstream-test/kafka-upstream.yaml --auto-approve --pat "$KONNECT_TOKEN" ``` +{: data-test-step="block" } ## Validate @@ -228,25 +242,32 @@ Requests sent before the data plane picks up the configuration return `404`. 1. Send a `POST` request with a JSON body to the Agent's Route: - {% validation request-check %} - url: /upstream-test - status_code: 200 - display_headers: true - method: POST - headers: - - 'Content-Type: application/json' - body: - hello: world - {% endvalidation %} +{% validation request-check %} +url: /upstream-test +status_code: 200 +display_headers: true +method: POST +headers: + - 'Content-Type: application/json' +body: + hello: world +indent: 3 +{% endvalidation %} The Policy terminates the request, so the response is a `200` with an acknowledgement from the Policy instead of a response from `config.url`. A `502` means the Policy didn't engage, so the Agent forwarded the request to the unused upstream port. 1. Read the message back from the topic: - ```sh - kafkactl -C kafkactl.yaml --context direct consume kong-upstream --from-beginning --exit | jq . - ``` +{% validation custom-command %} +command: | + kafkactl -C kafka-upstream-test/kafkactl.yaml --context direct consume kong-upstream --from-beginning --exit | jq . +expected: + return_code: 0 + message: '"uri": "/upstream-test"' +render_output: false +indent: 3 +{% endvalidation %} The output contains the request body, headers, method, and URI: diff --git a/app/_how-tos/operator/operator-konnect-ai-gateway-headroom.md b/app/_how-tos/operator/operator-konnect-ai-gateway-headroom.md index 832b664f24e..5435df16a03 100644 --- a/app/_how-tos/operator/operator-konnect-ai-gateway-headroom.md +++ b/app/_how-tos/operator/operator-konnect-ai-gateway-headroom.md @@ -72,7 +72,7 @@ faqs: * `false` forwards the original, uncompressed messages. Switch to it once compression is working, because with a global AI Policy a Headroom outage would otherwise fail every request through the gateway. --- -[Headroom](https://github.com/headroomlabs-ai/headroom) compresses agent traffic: tool results, large JSON payloads, search output, and logs. With the [AI Prompt Compressor Policy](/ai-gateway/policies/ai-prompt-compressor/) set to `provider: headroom`, the {{ site.ai_gateway }} data plane sends each request's messages to Headroom and forwards the compressed messages to the LLM. Headroom decides how much to compress. +[Headroom](https://github.com/headroomlabs-ai/headroom) compresses agent traffic: tool results, large JSON payloads, search output, and logs. With the [AI Prompt Compressor Policy](/ai-gateway/policies/ai-prompt-compressor/) set to `provider: headroom`, the {{ site.ai_gateway }} data plane sends each request's messages to Headroom and forwards the compressed messages to the LLM. Headroom decides how much to compress. This guide uses the following recommended layout: diff --git a/app/_includes/how-tos/steps/get-directory-name.md b/app/_includes/how-tos/steps/get-directory-name.md index 5a677e9dbce..8f0d30da41c 100644 --- a/app/_includes/how-tos/steps/get-directory-name.md +++ b/app/_includes/how-tos/steps/get-directory-name.md @@ -4,6 +4,9 @@ url: /v2/directories status_code: 200 method: GET +extract_body: + - name: 'data.0.name' + variable: DECK_DIRECTORY_NAME capture: - variable: DECK_DIRECTORY_NAME jq: ".data[0].name" diff --git a/app/_includes/how-tos/steps/principal.md b/app/_includes/how-tos/steps/principal.md index 0b0788a0cc4..dcf83c0107d 100644 --- a/app/_includes/how-tos/steps/principal.md +++ b/app/_includes/how-tos/steps/principal.md @@ -8,6 +8,9 @@ method: POST body: display_name: "example-principal" description: "Example principal" +extract_body: + - name: 'id' + variable: PRINCIPAL_ID capture: - variable: PRINCIPAL_ID jq: ".id" diff --git a/app/_includes/md/ai-gateway/v2/cel-acls.md b/app/_includes/md/ai-gateway/v2/cel-acls.md new file mode 100644 index 00000000000..20d58a55b73 --- /dev/null +++ b/app/_includes/md/ai-gateway/v2/cel-acls.md @@ -0,0 +1,37 @@ +CEL-based ACLs control access with [CEL](https://cel.dev/) boolean expressions instead of a static list of names. +Use them when access depends on Consumer attributes or request context, not only on fixed names. +To use them, set `allow_when` or `deny_when` on the {{include.scope}}[`access.acls`]({{include.anchor}}) object. +Each field is an array of expressions, 1 to 1024 characters each. +The data plane evaluates the expressions on each request, against the authenticated AI Consumer and the request. They use the same field vocabulary as [plugin conditions](/gateway/plugins/conditions/). +{% if include.allow_and_deny_together -%} +`allow_when` and `deny_when` are mutually exclusive with `allow` and `deny`. +For {{include.entity}}s, you can set `allow` and `deny` together, as described in [ACL evaluation logic](#acl-evaluation-logic). +{%- else -%} +Configure exactly one of `allow`, `deny`, `allow_when`, or `deny_when` per `access.acls` object. +{%- endif %} + +The following example allows requests from AI Consumers in the `internal-teams` AI Consumer Group, and from the AI Consumer `alice`: + +```yaml +access: + acls: + allow_when: + - 'consumer_group.names != null && "internal-teams" in consumer_group.names' + - 'consumer.username == "alice"' +``` + +{{site.konnect_short_name}} compiles and type-checks each expression when you create or update the {{include.entity}}. +{{site.konnect_short_name}} rejects an entry that doesn't compile or doesn't evaluate to a boolean with HTTP 400. +The error names the offending entry, for example `access.acls.allow_when[0]`. + +At runtime, entries are evaluated in order with OR semantics. +When you set `allow_when`, the request is allowed if any entry evaluates to true. +If an entry fails to evaluate, the request is denied with HTTP 403. +When you set `deny_when`, the request is denied if any entry evaluates to true. +If an entry fails to evaluate, the request fails closed with HTTP 500. + +When you set `allow_when` or `deny_when`, {{site.ai_gateway}} ignores `include_consumer_groups`. +It also doesn't send the `X-Consumer-Groups` and `X-Authenticated-Groups` headers upstream. + +CEL-based ACLs need {{site.base_gateway}} 3.16 or later data planes. +Data planes on earlier versions report the skipped configuration in their compatibility status. diff --git a/app/_includes/md/ai-gateway/v2/providers.md b/app/_includes/md/ai-gateway/v2/providers.md index 0cc520b158f..b95054836d9 100644 --- a/app/_includes/md/ai-gateway/v2/providers.md +++ b/app/_includes/md/ai-gateway/v2/providers.md @@ -680,9 +680,9 @@ rows: {% endtable %} {% if provider.capabilities.batches.note.content %}{{ batches_note_num }} {% if compare_provider %}**{{ include.variant_label }}:** {% endif %}{{ provider.capabilities.batches.note.content }}{% endif %} {% if compare_provider.capabilities.batches.note.content %}{{ compare_batches_note_num }} **{{ include.compare_variant_label }}:** {{ compare_provider.capabilities.batches.note.content }}{% endif %} + {:.warning} -> Batches are configured on a separate AI Model with `type: "api"`, distinct from regular models that handle synchronous capabilities like generate and embeddings. -> Create a dedicated AI Model exclusively for batches and files, as each model must be either a regular model or an API model, not both. +> Batch jobs run on an AI Model with [`type: "api"`](/ai-gateway/entities/ai-model/#schema-aigateway-model-type). Regular models handle synchronous capabilities like generate and embeddings, so a model that serves batches can't serve those capabilities. {%- endif -%} {% if has_files %} @@ -738,8 +738,7 @@ rows: {% if compare_provider.capabilities.files.note.content %}{{ compare_files_note_num }} **{{ include.compare_variant_label }}:** {{ compare_provider.capabilities.files.note.content }}{% endif %} {:.warning} -> Batches are configured on a separate AI Model with [`type: "api"`](/ai-gateway/entities/ai-model/#schema-aigateway-model-type), distinct from regular models that handle synchronous capabilities like generate and embeddings. -> Create a dedicated AI Model exclusively for batches and files, as each model must be either a regular model or an API model, not both. +> Files are managed through an AI Model with [`type: "api"`](/ai-gateway/entities/ai-model/#schema-aigateway-model-type), the same type that serves batches. Create one dedicated AI Model for batches and files, and keep generate and embeddings on a separate regular model, because each model is either a regular model or an API model, not both. {%- endif -%} {% if has_skills %} @@ -902,7 +901,7 @@ rows: {% endtable %} {% if provider.capabilities.decisions.note.content %}{{ decisions_note_num }} {% if compare_provider %}**{{ include.variant_label }}:** {% endif %}{{ provider.capabilities.decisions.note.content }}{% endif %} {% if compare_provider.capabilities.decisions.note.content %}{{ compare_decisions_note_num }} **{{ include.compare_variant_label }}:** {{ compare_provider.capabilities.decisions.note.content }}{% endif %} -{%- endif -%} +{%- endif %} ## {{ provider.name }} base URL @@ -916,9 +915,9 @@ rows: {% if compare_provider %} By default, {{site.ai_gateway}} routes {{ provider.name }} requests to {{ include.variant_label }} at `{{ provider.url_patterns.first }}`.{% if has_capability_path %} The `{capability_path}` is determined by the AI capability.{% endif %} -{{ compare_provider.variant_trigger }} This switches routing to {{ include.compare_variant_label }} at `{{ compare_provider.url_patterns.first }}`. +To route requests to {{ include.compare_variant_label }}, {{ compare_provider.variant_trigger }}. {{site.ai_gateway}} then sends them to `{{ compare_provider.url_patterns.first }}`. -{{site.ai_gateway}} uses the correct URL automatically based on this configuration. You only need to set `upstream_url` in your [AI Model](/ai-gateway/entities/ai-model/) configuration if you're using a self-hosted or {{ provider.name }}-compatible endpoint instead. +You don't need to set the URL yourself. You only need to set `upstream_url` in your [AI Model](/ai-gateway/entities/ai-model/) configuration if you're using a self-hosted or {{ provider.name }}-compatible endpoint instead. {% else %} {% if provider.url_is_variable %} The base URL is {{ provider.url_patterns.first }}.{% if has_capability_path %} The `{capability_path}` is determined by the AI capability.{% endif %} @@ -931,6 +930,39 @@ The base URL is `{{ provider.url_patterns.first }}`.{% if has_capability_path %} {{site.ai_gateway}} uses this URL automatically. You only need to configure a URL if you're using a self-hosted or {{ provider.name }}-compatible endpoint, in which case set the `upstream_url` option in your [AI Model](/ai-gateway/entities/ai-model/) configuration. {% endif %} +{% assign general_limitations = provider.limitations.general %} +{% assign compare_general_limitations = compare_provider.limitations.general %} +{% if general_limitations.size > 0 or compare_general_limitations.size > 0 %} + +## {{ provider.name }} limitations + +{{ provider.name }} has the following limitations in {{site.ai_gateway}}: + +{% if compare_provider %} +**{{ include.variant_label }}:** + +{% for limitation in general_limitations %} +- {{ limitation }} +{% endfor %} +{% if general_limitations.size == 0 or general_limitations == nil %} +- None. +{% endif %} + +**{{ include.compare_variant_label }}:** + +{% for limitation in compare_general_limitations %} +- {{ limitation }} +{% endfor %} +{% if compare_general_limitations.size == 0 or compare_general_limitations == nil %} +- None. +{% endif %} +{% else %} +{% for limitation in general_limitations %} +- {{ limitation }} +{% endfor %} +{% endif %} +{% endif %} + {% else %} Provider "{{ include.provider_name }}" not found. {% endif %} diff --git a/app/_includes/md/ai-gateway/v2/upstream-tls.md b/app/_includes/md/ai-gateway/v2/upstream-tls.md new file mode 100644 index 00000000000..80fa8aaaaad --- /dev/null +++ b/app/_includes/md/ai-gateway/v2/upstream-tls.md @@ -0,0 +1,32 @@ +When {{include.name}} connects to an upstream (the server at [`config.url`](#{{include.schema_prefix}}-url)), it does so over TLS by default, without presenting a client certificate, and trusts only the certificate authorities (CAs) in the data plane's default trust store. +Use the following fields in `config` when your upstream needs something different: + + +{% table %} +columns: + - title: Use case + key: use_case + - title: Field + key: field + - title: What to reference + key: reference +rows: + - use_case: | + The upstream requires mutual TLS (mTLS), so {{include.name}} must prove its identity to the upstream. + field: "[`config.certificates`](#{{include.schema_prefix}}-certificates)" + reference: | + One [AI Certificate](/ai-gateway/entities/ai-certificate/). It must include a private key. + The field is an array, but accepts only one entry. + - use_case: | + The upstream serves a certificate signed by a private or internal CA that the data plane doesn't trust by default. + field: "[`config.ca_certificates`](#{{include.schema_prefix}}-ca-certificates)" + reference: | + One or more [AI CA Certificates](/ai-gateway/entities/ai-ca-certificate/). Together, they replace the default trust store when {{include.name}} verifies the upstream. +{% endtable %} + + +You can use either field on its own, or both together. + +To reference a certificate, create the AI Certificate or AI CA Certificate first, then enter its `name` in the field. +The `name` of a certificate can't be changed after you create it, so the reference stays valid. +If a referenced name doesn't exist, the API returns an `HTTP 400` error. diff --git a/app/_includes/prereqs/kong-identity-directory.md b/app/_includes/prereqs/kong-identity-directory.md index b40be5e5101..6a06a5a1313 100644 --- a/app/_includes/prereqs/kong-identity-directory.md +++ b/app/_includes/prereqs/kong-identity-directory.md @@ -17,6 +17,9 @@ body: name: "kong-identity-directory" description: "Directory for this tutorial" allow_all_control_planes: true +extract_body: + - name: 'id' + variable: DIRECTORY_ID capture: - variable: DIRECTORY_ID jq: ".id" @@ -35,7 +38,7 @@ url: /v2/directories status_code: 200 method: GET extract_body: - - name: 'id' + - name: 'data.[0].id' variable: DIRECTORY_ID capture: - variable: DIRECTORY_ID diff --git a/app/_landing_pages/ai-gateway/ai-providers.yaml b/app/_landing_pages/ai-gateway/ai-providers.yaml index d5b4d83c2f9..dc3300993a4 100644 --- a/app/_landing_pages/ai-gateway/ai-providers.yaml +++ b/app/_landing_pages/ai-gateway/ai-providers.yaml @@ -131,6 +131,13 @@ rows: icon: /assets/icons/kimi.svg cta: url: /ai-gateway/ai-providers/kimi/ + - blocks: + - type: icon_card + config: + title: Baseten + icon: /assets/icons/baseten.svg + cta: + url: /ai-gateway/ai-providers/baseten/ - blocks: - type: icon_card config: diff --git a/app/_schemas/ai-gateway/policies/ACL.json b/app/_schemas/ai-gateway/policies/ACL.json index 99da3f14b1e..3805839d632 100644 --- a/app/_schemas/ai-gateway/policies/ACL.json +++ b/app/_schemas/ai-gateway/policies/ACL.json @@ -24,6 +24,15 @@ "config": { "type": "object", "properties": { + "deny_when": { + "type": "array", + "items": { + "type": "string", + "maxLength": 1024, + "minLength": 1 + }, + "description": "Deny the request if it matches any of these CEL boolean expressions evaluated against the request context (consumer, principal, HTTP attributes, consumer groups, etc.). Exactly one of `config.allow`, `config.deny`, `config.allow_when`, or `config.deny_when` must be specified." + }, "allow": { "type": "array", "items": { @@ -61,15 +70,6 @@ "minLength": 1 }, "description": "Allow the request if it matches any of these CEL boolean expressions evaluated against the request context (consumer, principal, HTTP attributes, consumer groups, etc.). Exactly one of `config.allow`, `config.deny`, `config.allow_when`, or `config.deny_when` must be specified." - }, - "deny_when": { - "type": "array", - "items": { - "type": "string", - "maxLength": 1024, - "minLength": 1 - }, - "description": "Deny the request if it matches any of these CEL boolean expressions evaluated against the request context (consumer, principal, HTTP attributes, consumer groups, etc.). Exactly one of `config.allow`, `config.deny`, `config.allow_when`, or `config.deny_when` must be specified." } } }, diff --git a/app/_schemas/ai-gateway/policies/Ace.json b/app/_schemas/ai-gateway/policies/Ace.json index 1497b4b8180..0502488c5ad 100644 --- a/app/_schemas/ai-gateway/policies/Ace.json +++ b/app/_schemas/ai-gateway/policies/Ace.json @@ -3,24 +3,60 @@ "config": { "type": "object", "properties": { + "anonymous": { + "type": "string", + "description": "An optional string (consumer UUID or username) value to use as an `anonymous` consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`. When set, the policy will skip ACE processing for requests that are already authenticated by other policies with higher priority." + }, + "match_policy": { + "type": "string", + "enum": [ + "if_present", + "required" + ], + "description": "Determines how the ACE policy will behave when a request doesn't match an existing operation from an API or API package in Dev Portal. The `required` setting requires every incoming request to match a defined operation. If a request doesn't match, ACE rejects the request outright with a 404. The `if_present` setting makes the ACE policy only engage with a request when it matches an operation, allowing a request to still be processed by other policies with a lower priority than ACE.", + "default": "if_present" + }, "rate_limiting": { "type": "object", "properties": { "redis": { "type": "object", "properties": { - "password": { + "server_name": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true }, - "sentinel_nodes": { + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "cluster_nodes": { "type": "array", "items": { "type": "object", "properties": { - "host": { + "ip": { "type": "string", "description": "A string representing a host name, such as example.com.", "default": "127.0.0.1" @@ -35,36 +71,106 @@ } }, "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, "ssl_verify": { "type": "boolean", "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", "default": true }, - "keepalive_backlog": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_pool_size": { "type": "integer", "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "port": { + "type": "integer", + "maximum": 65535, "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true }, - "host": { + "username": { "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, - "connect_timeout": { + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_backlog": { "type": "integer", "maximum": 2147483646, "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false }, "read_timeout": { "type": "integer", @@ -73,11 +179,6 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, "cloud_authentication": { "type": "object", "properties": { @@ -101,11 +202,6 @@ "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, "aws_access_key_id": { "type": "string", "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", @@ -124,17 +220,11 @@ "x-referenceable": true, "x-encrypted": true }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true - }, "aws_role_session_name": { "type": "string", "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "azure_client_id": { "type": "string", @@ -142,6 +232,17 @@ "x-referenceable": true, "x-encrypted": true }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-encrypted": true, + "x-referenceable": true + }, "azure_client_secret": { "type": "string", "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", @@ -156,94 +257,6 @@ } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true - }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." } } }, @@ -254,19 +267,6 @@ "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior (counter synchronization happens in each request's context and contributes directly to the latency of the request). A value greater than 0 results in asynchronous behavior and specifies the interval (in seconds) for synchronizing counters. The minimum allowed interval is 0.02 seconds (20ms). If omitted, the policy ignores sync behavior entirely and only stores counters in node memory." } } - }, - "anonymous": { - "type": "string", - "description": "An optional string (consumer UUID or username) value to use as an `anonymous` consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`. When set, the policy will skip ACE processing for requests that are already authenticated by other policies with higher priority." - }, - "match_policy": { - "type": "string", - "enum": [ - "if_present", - "required" - ], - "description": "Determines how the ACE policy will behave when a request doesn't match an existing operation from an API or API package in Dev Portal. The `required` setting requires every incoming request to match a defined operation. If a request doesn't match, ACE rejects the request outright with a 404. The `if_present` setting makes the ACE policy only engage with a request when it matches an operation, allowing a request to still be processed by other policies with a lower priority than ACE.", - "default": "if_present" } } }, @@ -289,7 +289,7 @@ "https" ] }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -297,9 +297,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -307,7 +307,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } }, "x-supported-partials": [ diff --git a/app/_schemas/ai-gateway/policies/Acme.json b/app/_schemas/ai-gateway/policies/Acme.json index 8785106be11..708a02d8700 100644 --- a/app/_schemas/ai-gateway/policies/Acme.json +++ b/app/_schemas/ai-gateway/policies/Acme.json @@ -28,72 +28,44 @@ "x-referenceable": true, "x-encrypted": true }, - "rsa_key_size": { - "type": "integer", - "enum": [ - 2048, - 3072, - 4096 - ], - "description": "RSA private key size for the certificate. The possible values are 2048, 3072, or 4096.", - "default": 4096 - }, - "domains": { - "type": "array", - "items": { - "type": "string" - }, - "description": "An array of strings representing hosts. A valid host is a string containing one or more labels separated by periods, with at most one wildcard label ('*')" - }, - "cert_type": { + "api_uri": { "type": "string", - "enum": [ - "ecc", - "rsa" - ], - "description": "The certificate type to create. The possible values are `rsa` for RSA certificate or `ecc` for EC certificate.", - "default": "rsa" + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "default": "https://acme-v02.api.letsencrypt.org/directory" + }, + "renew_threshold_days": { + "type": "number", + "description": "Days remaining to renew the certificate before it expires.", + "default": 14 }, "enable_ipv4_common_name": { "type": "boolean", "description": "A boolean value that controls whether to include the IPv4 address in the common name field of generated certificates.", "default": true }, - "account_key": { - "type": "object", - "properties": { - "key_id": { - "type": "string", - "description": "The Key ID.", - "x-encrypted": true - }, - "key_set": { - "type": "string", - "description": "The name of the key set to associate the Key ID with.", - "x-encrypted": true - } - }, - "required": [ - "key_id" - ], - "description": "The private key associated with the account." - }, - "eab_kid": { - "type": "string", - "description": "External account binding (EAB) key id. You usually don't need to set this unless it is explicitly required by the CA.", - "x-referenceable": true, - "x-encrypted": true - }, "eab_hmac_key": { "type": "string", "description": "External account binding (EAB) base64-encoded URL string of the HMAC key. You usually don't need to set this unless it is explicitly required by the CA.", "x-referenceable": true, "x-encrypted": true }, - "renew_threshold_days": { + "fail_backoff_minutes": { "type": "number", - "description": "Days remaining to renew the certificate before it expires.", - "default": 14 + "description": "Minutes to wait for each domain that fails to create a certificate. This applies to both a\nnew certificate and a renewal certificate.", + "default": 5 + }, + "preferred_chain": { + "type": "string", + "description": "A string value that specifies the preferred certificate chain to use when generating certificates." + }, + "cert_type": { + "type": "string", + "enum": [ + "ecc", + "rsa" + ], + "description": "The certificate type to create. The possible values are `rsa` for RSA certificate or `ecc` for EC certificate.", + "default": "rsa" }, "storage": { "type": "string", @@ -107,68 +79,51 @@ "description": "The backend storage type to use. In DB-less mode and Konnect, `kong` storage is unavailable. In hybrid mode and Konnect, `shm` storage is unavailable. `shm` storage does not persist during Kong restarts and does not work for Kong running on different machines, so consider using one of `kong`, `redis`, `consul`, or `vault` in production.", "default": "shm" }, - "api_uri": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "default": "https://acme-v02.api.letsencrypt.org/directory" - }, - "tos_accepted": { - "type": "boolean", - "description": "If you are using Let's Encrypt, you must set this to `true` to agree the terms of service.", - "default": false - }, - "allow_any_domain": { - "type": "boolean", - "description": "If set to `true`, the policy allows all domains and ignores any values in the `domains` list.", - "default": false - }, - "fail_backoff_minutes": { - "type": "number", - "description": "Minutes to wait for each domain that fails to create a certificate. This applies to both a\nnew certificate and a renewal certificate.", - "default": 5 - }, "storage_config": { "type": "object", "properties": { + "shm": { + "type": "object", + "properties": { + "shm_name": { + "type": "string", + "description": "Name of shared memory zone used for Kong API gateway storage", + "default": "kong" + } + } + }, + "kong": { + "type": "object", + "additionalProperties": true + }, "redis": { "type": "object", "properties": { - "password": { + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true }, "cloud_authentication": { "type": "object", "properties": { + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, "aws_is_serverless": { "type": "boolean", "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", "default": true }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, "aws_access_key_id": { "type": "string", "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", @@ -178,8 +133,8 @@ "aws_secret_access_key": { "type": "string", "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "aws_assume_role_arn": { "type": "string", @@ -193,6 +148,18 @@ "x-referenceable": true, "x-encrypted": true }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true + }, "azure_client_secret": { "type": "string", "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", @@ -205,39 +172,24 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_cache_name": { + "auth_provider": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_region": { + "aws_cache_name": { "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "x-referenceable": true - }, "server_name": { "type": "string", "description": "A string representing an SNI (server name indication) value for TLS.", @@ -259,6 +211,11 @@ }, "description": "Custom ACME Redis options" }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "x-referenceable": true + }, "port": { "type": "integer", "maximum": 65535, @@ -267,32 +224,32 @@ "default": 6379, "x-referenceable": true }, - "timeout": { + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "database": { "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true } } }, "consul": { "type": "object", "properties": { - "https": { - "type": "boolean", - "description": "Boolean representation of https.", - "default": false - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, "port": { "type": "integer", "maximum": 65535, @@ -312,30 +269,38 @@ "description": "Consul ACL token.", "x-referenceable": true, "x-encrypted": true + }, + "https": { + "type": "boolean", + "description": "Boolean representation of https.", + "default": false + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com." } } }, "vault": { "type": "object", "properties": { - "token": { - "type": "string", - "description": "Consul ACL token.", - "x-referenceable": true, - "x-encrypted": true - }, - "tls_server_name": { - "type": "string", - "description": "SNI used in request, default to host if omitted." - }, "auth_role": { "type": "string", "description": "The role to try and assign." }, + "https": { + "type": "boolean", + "description": "Boolean representation of https.", + "default": false + }, "host": { "type": "string", "description": "A string representing a host name, such as example.com." }, + "kv_path": { + "type": "string", + "description": "KV prefix path." + }, "timeout": { "type": "number", "description": "Timeout in milliseconds." @@ -345,14 +310,9 @@ "description": "Turn on TLS verification.", "default": true }, - "auth_method": { + "tls_server_name": { "type": "string", - "enum": [ - "kubernetes", - "token" - ], - "description": "Auth Method, default to token, can be 'token' or 'kubernetes'.", - "default": "token" + "description": "SNI used in request, default to host if omitted." }, "auth_path": { "type": "string", @@ -362,42 +322,82 @@ "type": "string", "description": "The path to the JWT." }, - "https": { - "type": "boolean", - "description": "Boolean representation of https.", - "default": false - }, "port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive." }, - "kv_path": { + "token": { "type": "string", - "description": "KV prefix path." - } - } - }, - "shm": { - "type": "object", - "properties": { - "shm_name": { + "description": "Consul ACL token.", + "x-referenceable": true, + "x-encrypted": true + }, + "auth_method": { "type": "string", - "description": "Name of shared memory zone used for Kong API gateway storage", - "default": "kong" + "enum": [ + "kubernetes", + "token" + ], + "description": "Auth Method, default to token, can be 'token' or 'kubernetes'.", + "default": "token" } } - }, - "kong": { - "type": "object", - "additionalProperties": true } } }, - "preferred_chain": { + "account_key": { + "type": "object", + "properties": { + "key_id": { + "type": "string", + "description": "The Key ID.", + "x-encrypted": true + }, + "key_set": { + "type": "string", + "description": "The name of the key set to associate the Key ID with.", + "x-encrypted": true + } + }, + "required": [ + "key_id" + ], + "description": "The private key associated with the account." + }, + "tos_accepted": { + "type": "boolean", + "description": "If you are using Let's Encrypt, you must set this to `true` to agree the terms of service.", + "default": false + }, + "eab_kid": { "type": "string", - "description": "A string value that specifies the preferred certificate chain to use when generating certificates." + "description": "External account binding (EAB) key id. You usually don't need to set this unless it is explicitly required by the CA.", + "x-referenceable": true, + "x-encrypted": true + }, + "rsa_key_size": { + "type": "integer", + "enum": [ + 2048, + 3072, + 4096 + ], + "description": "RSA private key size for the certificate. The possible values are 2048, 3072, or 4096.", + "default": 4096 + }, + "domains": { + "type": "array", + "items": { + "type": "string" + }, + "description": "An array of strings representing hosts. A valid host is a string containing one or more labels separated by periods, with at most one wildcard label ('*')" + }, + "allow_any_domain": { + "type": "boolean", + "description": "If set to `true`, the policy allows all domains and ignores any values in the `domains` list.", + "default": false } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiA2aProxy.json b/app/_schemas/ai-gateway/policies/AiA2aProxy.json index ffbeb51d6ea..4803002ffc0 100644 --- a/app/_schemas/ai-gateway/policies/AiA2aProxy.json +++ b/app/_schemas/ai-gateway/policies/AiA2aProxy.json @@ -22,26 +22,6 @@ "config": { "type": "object", "properties": { - "logging": { - "type": "object", - "properties": { - "log_payloads": { - "type": "boolean", - "description": "If enabled, logs request/response bodies to Kong log policy(s) output. Requires log_statistics to be enabled.", - "default": false - }, - "max_payload_size": { - "type": "integer", - "description": "Maximum size in bytes for logged request/response payloads. Payloads exceeding this size will be truncated.", - "default": 1048576 - }, - "log_statistics": { - "type": "boolean", - "description": "If enabled, adds A2A metrics to Kong log policy(s) output.", - "default": false - } - } - }, "auth": { "type": "object", "properties": { @@ -57,26 +37,6 @@ "aws_iam": { "type": "object", "properties": { - "role_session_name": { - "type": "string", - "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." - }, - "sts_endpoint_url": { - "type": "string", - "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." - }, - "aws_access_key_id": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, "aws_session_token": { "type": "string", "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance.", @@ -96,6 +56,26 @@ "assume_role_arn": { "type": "string", "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + }, + "role_session_name": { + "type": "string", + "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + }, + "sts_endpoint_url": { + "type": "string", + "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." + }, + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-encrypted": true, + "x-referenceable": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Common AWS authentication options." @@ -111,26 +91,6 @@ "proxy_config": { "type": "object", "properties": { - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, "https_proxy_host": { "type": "string", "description": "A string representing a host name, such as example.com." @@ -153,6 +113,46 @@ "type": "string", "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + } + } + }, + "logging": { + "type": "object", + "properties": { + "log_statistics": { + "type": "boolean", + "description": "If enabled, adds A2A metrics to Kong log policy(s) output.", + "default": false + }, + "log_payloads": { + "type": "boolean", + "description": "If enabled, logs request/response bodies to Kong log policy(s) output. Requires log_statistics to be enabled.", + "default": false + }, + "max_payload_size": { + "type": "integer", + "description": "Maximum size in bytes for logged request/response payloads. Payloads exceeding this size will be truncated.", + "default": 1048576 } } } diff --git a/app/_schemas/ai-gateway/policies/AiAwsGuardrails.json b/app/_schemas/ai-gateway/policies/AiAwsGuardrails.json index ccb3a90441d..73287e47a71 100644 --- a/app/_schemas/ai-gateway/policies/AiAwsGuardrails.json +++ b/app/_schemas/ai-gateway/policies/AiAwsGuardrails.json @@ -22,39 +22,46 @@ "config": { "type": "object", "properties": { - "aws_secret_access_key": { - "type": "string", - "description": "The AWS secret access key to use for authentication", - "x-referenceable": true, - "x-encrypted": true - }, "log_blocked_content": { "type": "boolean", "description": "Whether to log prompts and responses that are blocked by the guardrail.", "default": false }, - "guardrails_id": { - "type": "string", - "description": "The guardrail identifier used in the request to apply the guardrail." - }, - "text_source": { - "type": "string", - "enum": [ - "concatenate_all_content", - "concatenate_user_content", - "last_message" - ], - "description": "Select where to pick the 'text' for the guardrail service request.", - "default": "concatenate_all_content" + "stop_on_error": { + "type": "boolean", + "description": "Stop processing if an error occurs.", + "default": true }, "response_buffer_size": { "type": "number", "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", "default": 100 }, + "aws_region": { + "type": "string", + "description": "The AWS region to use for the Bedrock API" + }, + "continue_on_detection": { + "type": "boolean", + "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", + "default": false + }, + "guardrails_version": { + "type": "string", + "description": "The guardrail version used in the request to apply the guardrail. Note that the value of this field must match the pattern `(([1-9][0-9]{0,7})|(DRAFT))` according to the AWS documentation https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ApplyGuardrail.html#API_runtime_ApplyGuardrail_RequestSyntax." + }, + "allow_masking": { + "type": "boolean", + "description": "Allow masking the request/response instead of blocking it. Streaming will be disabled if this is enabled.", + "default": false + }, "proxy_config": { "type": "object", "properties": { + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, "https_proxy_port": { "type": "integer", "maximum": 65535, @@ -93,30 +100,54 @@ "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." } } }, - "rejection_mode": { + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", + "default": true + }, + "guardrails_id": { + "type": "string", + "description": "The guardrail identifier used in the request to apply the guardrail." + }, + "timeout": { + "type": "number", + "description": "Connection timeout with the guardrail service.", + "default": 10000 + }, + "text_source": { "type": "string", "enum": [ - "none", - "stealth", - "verbose" + "concatenate_all_content", + "concatenate_user_content", + "last_message" ], - "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", - "default": "none" + "description": "Select where to pick the 'text' for the guardrail service request.", + "default": "concatenate_all_content" + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The target AWS IAM role ARN used to access the guardrails service" + }, + "aws_role_session_name": { + "type": "string", + "description": "The identifier of the assumed role session" }, "aws_sts_endpoint_url": { "type": "string", "description": "Override the STS endpoint URL when assuming a different role" }, - "guardrails_version": { + "rejection_mode": { "type": "string", - "description": "The guardrail version used in the request to apply the guardrail. Note that the value of this field must match the pattern `(([1-9][0-9]{0,7})|(DRAFT))` according to the AWS documentation https://docs.aws.amazon.com/bedrock/latest/APIReference/API_runtime_ApplyGuardrail.html#API_runtime_ApplyGuardrail_RequestSyntax." + "enum": [ + "none", + "stealth", + "verbose" + ], + "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", + "default": "none" }, "guarding_mode": { "type": "string", @@ -128,48 +159,17 @@ "description": "The guardrail mode to use for the request.", "default": "INPUT" }, - "allow_masking": { - "type": "boolean", - "description": "Allow masking the request/response instead of blocking it. Streaming will be disabled if this is enabled.", - "default": false - }, - "aws_region": { - "type": "string", - "description": "The AWS region to use for the Bedrock API" - }, "aws_access_key_id": { "type": "string", "description": "The AWS access key ID to use for authentication", "x-referenceable": true, "x-encrypted": true }, - "aws_assume_role_arn": { - "type": "string", - "description": "The target AWS IAM role ARN used to access the guardrails service" - }, - "aws_role_session_name": { + "aws_secret_access_key": { "type": "string", - "description": "The identifier of the assumed role session" - }, - "stop_on_error": { - "type": "boolean", - "description": "Stop processing if an error occurs.", - "default": true - }, - "timeout": { - "type": "number", - "description": "Connection timeout with the guardrail service.", - "default": 10000 - }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", - "default": true - }, - "continue_on_detection": { - "type": "boolean", - "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", - "default": false + "description": "The AWS secret access key to use for authentication", + "x-referenceable": true, + "x-encrypted": true } }, "required": [ @@ -178,7 +178,7 @@ "guardrails_version" ] }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -186,9 +186,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -196,9 +196,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -206,9 +206,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -216,7 +216,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiAzureContentSafety.json b/app/_schemas/ai-gateway/policies/AiAzureContentSafety.json index a115585764e..49d1f758c55 100644 --- a/app/_schemas/ai-gateway/policies/AiAzureContentSafety.json +++ b/app/_schemas/ai-gateway/policies/AiAzureContentSafety.json @@ -3,27 +3,49 @@ "config": { "type": "object", "properties": { + "reveal_failure_reason": { + "type": "boolean", + "description": "Set true to tell the caller why their request was rejected, if so.", + "default": true + }, + "response_buffer_size": { + "type": "number", + "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", + "default": 100 + }, + "azure_api_version": { + "type": "string", + "minLength": 1, + "description": "Sets the ?api-version URL parameter, used for defining the Azure Content Services interchange format.", + "default": "2023-10-01" + }, "content_safety_key": { "type": "string", "description": "If `azure_use_managed_identity` is true, set the API key to call Content Safety.", "x-referenceable": true, "x-encrypted": true }, + "output_type": { + "type": "string", + "enum": [ + "EightSeverityLevels", + "FourSeverityLevels" + ], + "description": "See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/content-filter#content-filtering-categories", + "default": "FourSeverityLevels" + }, + "blocklist_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Use these configured blocklists (in Azure Content Services) when inspecting content." + }, "halt_on_blocklist_hit": { "type": "boolean", "description": "Tells Azure to reject the request if any blocklist filter is hit.", "default": true }, - "text_source": { - "type": "string", - "enum": [ - "concatenate_all_content", - "concatenate_user_content", - "last_message" - ], - "description": "Select where to pick the 'text' for the guardrail service request.", - "default": "concatenate_all_content" - }, "proxy_config": { "type": "object", "properties": { @@ -72,6 +94,11 @@ } } }, + "log_blocked_content": { + "type": "boolean", + "description": "Whether to log prompts and responses that are blocked by the guardrail.", + "default": false + }, "content_safety_url": { "type": "string", "description": "Full URL, inc protocol, of the Azure Content Safety instance.", @@ -82,39 +109,45 @@ "description": "If checked, uses (if set) `azure_client_id`, `azure_client_secret`, and/or `azure_tenant_id` for Azure authentication, via Managed or User-assigned identity", "default": false }, - "azure_client_id": { - "type": "string", - "description": "If `azure_use_managed_identity` is true, set the client ID if required." - }, - "azure_tenant_id": { + "text_source": { "type": "string", - "description": "If `azure_use_managed_identity` is true, set the tenant ID if required." - }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", - "default": true + "enum": [ + "concatenate_all_content", + "concatenate_user_content", + "last_message" + ], + "description": "Select where to pick the 'text' for the guardrail service request.", + "default": "concatenate_all_content" }, "continue_on_detection": { "type": "boolean", "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", "default": false }, - "azure_client_secret": { + "rejection_mode": { "type": "string", - "description": "If `azure_use_managed_identity` is true, set the client secret if required.", - "x-encrypted": true + "enum": [ + "none", + "stealth", + "verbose" + ], + "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", + "default": "none" + }, + "azure_tenant_id": { + "type": "string", + "description": "If `azure_use_managed_identity` is true, set the tenant ID if required." }, "categories": { "type": "array", "items": { "type": "object", "properties": { - "rejection_level": { - "type": "integer" - }, "name": { "type": "string" + }, + "rejection_level": { + "type": "integer" } }, "required": [ @@ -124,67 +157,34 @@ }, "description": "Array of categories, and their thresholds, to measure on." }, - "output_type": { + "guarding_mode": { "type": "string", "enum": [ - "EightSeverityLevels", - "FourSeverityLevels" + "BOTH", + "INPUT", + "OUTPUT" ], - "description": "See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/content-filter#content-filtering-categories", - "default": "FourSeverityLevels" + "description": "The guardrail mode to use for the request.", + "default": "INPUT" }, "stop_on_error": { "type": "boolean", "description": "Stop processing if an error occurs.", "default": true }, - "log_blocked_content": { - "type": "boolean", - "description": "Whether to log prompts and responses that are blocked by the guardrail.", - "default": false - }, - "azure_api_version": { - "type": "string", - "minLength": 1, - "description": "Sets the ?api-version URL parameter, used for defining the Azure Content Services interchange format.", - "default": "2023-10-01" - }, - "reveal_failure_reason": { + "ssl_verify": { "type": "boolean", - "description": "Set true to tell the caller why their request was rejected, if so.", + "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", "default": true }, - "blocklist_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Use these configured blocklists (in Azure Content Services) when inspecting content." - }, - "guarding_mode": { + "azure_client_id": { "type": "string", - "enum": [ - "BOTH", - "INPUT", - "OUTPUT" - ], - "description": "The guardrail mode to use for the request.", - "default": "INPUT" - }, - "response_buffer_size": { - "type": "number", - "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", - "default": 100 + "description": "If `azure_use_managed_identity` is true, set the client ID if required." }, - "rejection_mode": { + "azure_client_secret": { "type": "string", - "enum": [ - "none", - "stealth", - "verbose" - ], - "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", - "default": "none" + "description": "If `azure_use_managed_identity` is true, set the client secret if required.", + "x-encrypted": true } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiCustomGuardrail.json b/app/_schemas/ai-gateway/policies/AiCustomGuardrail.json index bf42fafeb88..b2d0df2d0ba 100644 --- a/app/_schemas/ai-gateway/policies/AiCustomGuardrail.json +++ b/app/_schemas/ai-gateway/policies/AiCustomGuardrail.json @@ -22,44 +22,6 @@ "config": { "type": "object", "properties": { - "allow_masking": { - "type": "boolean", - "description": "Allow masking the request/response instead of blocking it. Streaming will be disabled if this is enabled.", - "default": false - }, - "functions": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-lua-required": true - }, - "description": "Custom functions to be used in expression templates." - }, - "response_buffer_size": { - "type": "number", - "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", - "default": 100 - }, - "text_source": { - "type": "string", - "enum": [ - "concatenate_all_content", - "concatenate_user_content", - "last_message" - ], - "description": "Select where to pick the 'text' for the guardrail service request.", - "default": "last_message" - }, - "stop_on_error": { - "type": "boolean", - "description": "Stop processing if an error occurs.", - "default": true - }, - "timeout": { - "type": "number", - "description": "Connection timeout with the guardrail service.", - "default": 10000 - }, "params": { "type": "object", "additionalProperties": { @@ -69,87 +31,9 @@ }, "description": "Parameters to be used in the guardrail service request. Keys are the parameter name and values can be either Lua expressions in the form `$(some_lua_expression)`or string. For expression, it will be evaluated as the value for the corresponding key. For string, it will be attempted to be parsed as string in JSON format, otherwise it will be used as is." }, - "custom_metrics": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "A list of custom metrics to be recorded." - }, - "proxy_config": { - "type": "object", - "properties": { - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "proxy_scheme": { - "type": "string", - "enum": [ - "http" - ], - "description": "The proxy scheme to use when connecting. Only `http` is supported.", - "default": "http" - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - } - } - }, - "log_blocked_content": { - "type": "boolean", - "description": "Whether to log prompts and responses that are blocked by the guardrail.", - "default": false - }, - "guarding_mode": { - "type": "string", - "enum": [ - "BOTH", - "INPUT", - "OUTPUT" - ], - "description": "The guardrail mode to use for the request.", - "default": "INPUT" - }, "request": { "type": "object", "properties": { - "queries": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "A map used to evaluate a JSON object. Keys are the field names in the new object, and values can be either Lua expressions in the form `$(some_lua_expression)`or string. For expression, it will be evaluated as the value for the corresponding key. For string, it will be decoded as string in JSON format or be used as is." - }, "auth": { "type": "object", "properties": { @@ -161,8 +45,8 @@ "value": { "type": "string", "description": "Specify the full token value for 'name'.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, "location": { "type": "string", @@ -196,6 +80,14 @@ "x-referenceable": true }, "description": "A map used to evaluate a JSON object. Keys are the field names in the new object, and values can be either Lua expressions in the form `$(some_lua_expression)`or string. For expression, it will be evaluated as the value for the corresponding key. For string, it will be decoded as string in JSON format or be used as is." + }, + "queries": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "A map used to evaluate a JSON object. Keys are the field names in the new object, and values can be either Lua expressions in the form `$(some_lua_expression)`or string. For expression, it will be evaluated as the value for the corresponding key. For string, it will be decoded as string in JSON format or be used as is." } }, "required": [ @@ -221,20 +113,89 @@ ], "description": "Configuration specific to parse guardrail response." }, - "metrics": { + "functions": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-lua-required": true + }, + "description": "Custom functions to be used in expression templates." + }, + "continue_on_detection": { + "type": "boolean", + "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", + "default": false + }, + "rejection_mode": { + "type": "string", + "enum": [ + "none", + "stealth", + "verbose" + ], + "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", + "default": "none" + }, + "guarding_mode": { + "type": "string", + "enum": [ + "BOTH", + "INPUT", + "OUTPUT" + ], + "description": "The guardrail mode to use for the request.", + "default": "INPUT" + }, + "allow_masking": { + "type": "boolean", + "description": "Allow masking the request/response instead of blocking it. Streaming will be disabled if this is enabled.", + "default": false + }, + "proxy_config": { "type": "object", "properties": { - "block_detail": { + "auth_username": { "type": "string", - "description": "Metric to indicate the detail for blocking the input." + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true }, - "masked": { + "auth_password": { "type": "string", - "description": "Metric to indicate whether the input was masked." + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true }, - "block_reason": { + "no_proxy": { "type": "string", - "description": "Metric to indicate the reason for blocking the input." + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" } } }, @@ -243,20 +204,59 @@ "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", "default": true }, - "continue_on_detection": { + "log_blocked_content": { "type": "boolean", - "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", + "description": "Whether to log prompts and responses that are blocked by the guardrail.", "default": false }, - "rejection_mode": { + "text_source": { "type": "string", "enum": [ - "none", - "stealth", - "verbose" + "concatenate_all_content", + "concatenate_user_content", + "last_message" ], - "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", - "default": "none" + "description": "Select where to pick the 'text' for the guardrail service request.", + "default": "last_message" + }, + "timeout": { + "type": "number", + "description": "Connection timeout with the guardrail service.", + "default": 10000 + }, + "custom_metrics": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "A list of custom metrics to be recorded." + }, + "stop_on_error": { + "type": "boolean", + "description": "Stop processing if an error occurs.", + "default": true + }, + "metrics": { + "type": "object", + "properties": { + "block_detail": { + "type": "string", + "description": "Metric to indicate the detail for blocking the input." + }, + "masked": { + "type": "string", + "description": "Metric to indicate whether the input was masked." + }, + "block_reason": { + "type": "string", + "description": "Metric to indicate the reason for blocking the input." + } + } + }, + "response_buffer_size": { + "type": "number", + "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", + "default": 100 } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiGcpModelArmor.json b/app/_schemas/ai-gateway/policies/AiGcpModelArmor.json index ace242607ac..ef612a479e8 100644 --- a/app/_schemas/ai-gateway/policies/AiGcpModelArmor.json +++ b/app/_schemas/ai-gateway/policies/AiGcpModelArmor.json @@ -1,62 +1,8 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "response_failure_message": { - "type": "string", - "description": "The message to return when a failure occurs on the response phase.", - "default": "Response was filtered by GCP Model Armor" - }, - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false - }, - "gcp_oauth_token_url": { - "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", - "x-referenceable": true - }, - "gcp_metadata_url": { - "type": "string", - "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", - "x-referenceable": true - }, - "log_blocked_content": { - "type": "boolean", - "description": "Whether to log prompts and responses that are blocked by the guardrail.", - "default": false - }, - "reveal_failure_categories": { - "type": "boolean", - "description": "Whether to reveal failure categories in the response to the caller.", - "default": false - }, - "request_failure_message": { - "type": "string", - "description": "The message to return when a failure occurs on the request phase.", - "default": "Request was filtered by GCP Model Armor" - }, "text_source": { "type": "string", "enum": [ @@ -67,6 +13,12 @@ "description": "Select where to pick the 'text' for the guardrail service request.", "default": "last_message" }, + "gcp_service_account_json": { + "type": "string", + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT` or from the instance/container metadata service.", + "x-referenceable": true, + "x-encrypted": true + }, "proxy_config": { "type": "object", "properties": { @@ -115,6 +67,31 @@ } } }, + "continue_on_detection": { + "type": "boolean", + "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", + "default": false + }, + "stop_on_error": { + "type": "boolean", + "description": "Stop processing if an error occurs.", + "default": true + }, + "guarding_mode": { + "type": "string", + "enum": [ + "BOTH", + "INPUT", + "OUTPUT" + ], + "description": "The guardrail mode to use for the request.", + "default": "INPUT" + }, + "gcp_use_service_account": { + "type": "boolean", + "description": "Use service account auth for GCP-based providers and models.", + "default": false + }, "rejection_mode": { "type": "string", "enum": [ @@ -129,6 +106,21 @@ "type": "string", "description": "GCP Location ID for the GCP Model Armor subscription." }, + "reveal_failure_categories": { + "type": "boolean", + "description": "Whether to reveal failure categories in the response to the caller.", + "default": false + }, + "gcp_oauth_token_url": { + "type": "string", + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true + }, + "gcp_metadata_url": { + "type": "string", + "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "x-referenceable": true + }, "template_id": { "type": "string", "description": "GCP Model Armor Template ID to enforce." @@ -138,49 +130,38 @@ "description": "Enables multi-language detection mode. Must be used with 'source_language'.", "default": false }, - "guarding_mode": { + "source_language": { "type": "string", - "enum": [ - "BOTH", - "INPUT", - "OUTPUT" - ], - "description": "The guardrail mode to use for the request.", - "default": "INPUT" - }, - "response_buffer_size": { - "type": "number", - "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", - "default": 100 - }, - "stop_on_error": { - "type": "boolean", - "description": "Stop processing if an error occurs.", - "default": true - }, - "timeout": { - "type": "number", - "description": "Connection timeout with the guardrail service.", - "default": 10000 + "description": "Source language (ISO code) to use when 'enable_multi_language_detection' is enabled." }, - "gcp_service_account_json": { + "request_failure_message": { "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT` or from the instance/container metadata service.", - "x-referenceable": true, - "x-encrypted": true + "description": "The message to return when a failure occurs on the request phase.", + "default": "Request was filtered by GCP Model Armor" }, - "continue_on_detection": { + "log_blocked_content": { "type": "boolean", - "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", + "description": "Whether to log prompts and responses that are blocked by the guardrail.", "default": false }, "project_id": { "type": "string", "description": "GCP Project ID for the GCP Model Armor subscription." }, - "source_language": { + "timeout": { + "type": "number", + "description": "Connection timeout with the guardrail service.", + "default": 10000 + }, + "response_failure_message": { "type": "string", - "description": "Source language (ISO code) to use when 'enable_multi_language_detection' is enabled." + "description": "The message to return when a failure occurs on the response phase.", + "default": "Response was filtered by GCP Model Armor" + }, + "response_buffer_size": { + "type": "number", + "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", + "default": 100 } }, "required": [ @@ -189,7 +170,26 @@ "template_id" ] }, - "service": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "route": { "type": "object", "properties": { "id": { @@ -197,9 +197,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -207,9 +207,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -217,9 +217,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -227,7 +227,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiLakeraGuard.json b/app/_schemas/ai-gateway/policies/AiLakeraGuard.json index ff61a09555e..2db5de9afb7 100644 --- a/app/_schemas/ai-gateway/policies/AiLakeraGuard.json +++ b/app/_schemas/ai-gateway/policies/AiLakeraGuard.json @@ -22,9 +22,45 @@ "config": { "type": "object", "properties": { + "project_id": { + "type": "string", + "description": "Project ID to apply filters from. If null, it will use the subscription's default project.", + "x-referenceable": true + }, + "reveal_failure_categories": { + "type": "boolean", + "description": "Whether to reveal failure categories in the response to the caller.", + "default": false + }, + "request_failure_message": { + "type": "string", + "description": "The message to return when a failure occurs on the request phase.", + "default": "Request was filtered by Lakera Guard" + }, + "response_failure_message": { + "type": "string", + "description": "The message to return when a failure occurs on the response phase.", + "default": "Response was filtered by Lakera Guard" + }, "proxy_config": { "type": "object", "properties": { + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, "proxy_scheme": { "type": "string", "enum": [ @@ -51,65 +87,29 @@ "http_proxy_host": { "type": "string", "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." } } }, - "api_key": { - "type": "string", - "description": "API key for the Lakera Guard subscription.", - "x-referenceable": true, - "x-encrypted": true + "log_blocked_content": { + "type": "boolean", + "description": "Whether to log prompts and responses that are blocked by the guardrail.", + "default": false }, - "project_id": { - "type": "string", - "description": "Project ID to apply filters from. If null, it will use the subscription's default project.", - "x-referenceable": true + "response_buffer_size": { + "type": "number", + "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", + "default": 100 }, - "stop_on_error": { + "verify_ssl": { "type": "boolean", - "description": "Stop processing if an error occurs.", + "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", "default": true }, - "response_failure_message": { - "type": "string", - "description": "The message to return when a failure occurs on the response phase.", - "default": "Response was filtered by Lakera Guard" - }, - "guarding_mode": { - "type": "string", - "enum": [ - "BOTH", - "INPUT", - "OUTPUT" - ], - "description": "The guardrail mode to use for the request.", - "default": "INPUT" - }, - "text_source": { + "lakera_service_url": { "type": "string", - "enum": [ - "concatenate_all_content", - "concatenate_user_content", - "last_message" - ], - "description": "Select where to pick the 'text' for the Lakera Guard request (when text/generation is selected).", - "default": "concatenate_all_content" + "description": "The guard-operation URL of the Lakera Guard service. Defaults to the SaaS /v2/guard endpoint. It can be set to a locally hosted instance of Lakera Guard.", + "default": "https://api.lakera.ai/v2/guard", + "x-referenceable": true }, "continue_on_detection": { "type": "boolean", @@ -126,45 +126,45 @@ "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", "default": "none" }, - "log_blocked_content": { - "type": "boolean", - "description": "Whether to log prompts and responses that are blocked by the guardrail.", - "default": false - }, - "lakera_service_url": { + "api_key": { "type": "string", - "description": "The guard-operation URL of the Lakera Guard service. Defaults to the SaaS /v2/guard endpoint. It can be set to a locally hosted instance of Lakera Guard.", - "default": "https://api.lakera.ai/v2/guard", - "x-referenceable": true + "description": "API key for the Lakera Guard subscription.", + "x-referenceable": true, + "x-encrypted": true + }, + "stop_on_error": { + "type": "boolean", + "description": "Stop processing if an error occurs.", + "default": true }, "timeout": { "type": "number", "description": "Connection timeout with the guardrail service.", "default": 10000 }, - "request_failure_message": { + "guarding_mode": { "type": "string", - "description": "The message to return when a failure occurs on the request phase.", - "default": "Request was filtered by Lakera Guard" - }, - "response_buffer_size": { - "type": "number", - "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", - "default": 100 - }, - "reveal_failure_categories": { - "type": "boolean", - "description": "Whether to reveal failure categories in the response to the caller.", - "default": false + "enum": [ + "BOTH", + "INPUT", + "OUTPUT" + ], + "description": "The guardrail mode to use for the request.", + "default": "INPUT" }, - "verify_ssl": { - "type": "boolean", - "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", - "default": true + "text_source": { + "type": "string", + "enum": [ + "concatenate_all_content", + "concatenate_user_content", + "last_message" + ], + "description": "Select where to pick the 'text' for the Lakera Guard request (when text/generation is selected).", + "default": "concatenate_all_content" } } }, - "consumer_group": { + "route": { "type": "object", "properties": { "id": { @@ -172,9 +172,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -182,9 +182,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -192,9 +192,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "consumer": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -202,7 +202,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/AiLlmAsJudge.json b/app/_schemas/ai-gateway/policies/AiLlmAsJudge.json index e64f89f203a..77c78484fde 100644 --- a/app/_schemas/ai-gateway/policies/AiLlmAsJudge.json +++ b/app/_schemas/ai-gateway/policies/AiLlmAsJudge.json @@ -1,191 +1,103 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { - "message_countback": { - "type": "number", - "maximum": 1000, - "minimum": 1, - "description": "Number of messages in the chat history to use for evaluating the request", - "default": 1 - }, - "ignore_system_prompts": { - "type": "boolean", - "description": "Ignore and discard any system prompts when evaluating the request", - "default": true - }, - "ignore_tool_prompts": { - "type": "boolean", - "description": "Ignore and discard any tool prompts when evaluating the request", - "default": true - }, - "sampling_rate": { - "type": "number", - "maximum": 1, - "minimum": 0, - "description": "Judging request sampling rate for configuring the probability-based sampler.", - "default": 1 - }, - "proxy_config": { - "type": "object", - "properties": { - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "proxy_scheme": { - "type": "string", - "enum": [ - "http" - ], - "description": "The proxy scheme to use when connecting. Only `http` is supported.", - "default": "http" - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - } - } - }, "inject_score_header": { "type": "boolean", "description": "Expose the computed judge score in a response header.", "default": false }, - "score_header_name": { - "type": "string", - "description": "Name of the response header used to expose the judge score.", - "default": "X-Kong-LLM-Accuracy-Score" - }, - "prompt": { - "type": "string", - "description": "Use this prompt to tune the LLM system/assistant message for the llm as a judge prompt.", - "default": "You are a strict evaluator. You will be given a prompt and a response. Your task is to judge whether the response is correct or incorrect. You must assign a score between 1 and 100, where: 100 represents a completely correct and ideal response, 1 represents a completely incorrect or irrelevant response. Your score must be a single number only — no text, labels, or explanations. Use the full range of values (e.g., 13, 47, 86), not just round numbers like 10, 50, or 100. Be accurate and consistent, as this score will be used by another model for learning and evaluation." - }, - "ignore_assistant_prompts": { - "type": "boolean", - "description": "Ignore and discard any assistant prompts when evaluating the request", - "default": true - }, - "http_timeout": { - "type": "integer", - "description": "Timeout in milliseconds for the AI upstream service.", - "default": 60000 - }, - "https_verify": { - "type": "boolean", - "description": "Verify the TLS certificate of the AI upstream service.", - "default": true - }, "llm": { "type": "object", "properties": { - "route_type": { - "type": "string", - "enum": [ - "audio/v1/audio/speech", - "audio/v1/audio/transcriptions", - "audio/v1/audio/translations", - "image/v1/images/edits", - "image/v1/images/generations", - "llm/v1/assistants", - "llm/v1/batches", - "llm/v1/chat", - "llm/v1/completions", - "llm/v1/embeddings", - "llm/v1/files", - "llm/v1/responses", - "llm/v1/skills", - "passthrough", - "realtime/v1/realtime", - "video/v1/videos/generations" - ], - "description": "The model's operation implementation, for this provider. " - }, "auth": { "type": "object", "properties": { - "gcp_service_account_json": { + "gcp_workload_identity_federation_source": { "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", + "enum": [ + "aws_iam", + "off" + ], + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." + }, + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-encrypted": true, + "x-referenceable": true + }, + "param_value": { + "type": "string", + "description": "Specify the full parameter value for 'param_name'.", "x-referenceable": true, "x-encrypted": true }, - "gcp_metadata_url": { + "azure_client_id": { "type": "string", - "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", "x-referenceable": true }, - "allow_override": { + "azure_tenant_id": { + "type": "string", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "x-referenceable": true + }, + "gcp_use_service_account": { "type": "boolean", - "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "description": "Use service account auth for GCP-based providers and models.", "default": false }, - "param_location": { - "type": "string", - "enum": [ - "body", - "query" - ], - "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." - }, - "azure_client_secret": { + "gcp_service_account_json": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", "x-referenceable": true, "x-encrypted": true }, - "aws_secret_access_key": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true + "allow_override": { + "type": "boolean", + "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "default": false }, "header_name": { "type": "string", "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", "x-referenceable": true }, - "azure_client_id": { + "param_name": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", + "description": "If AI model requires authentication via query parameter, specify its name here.", "x-referenceable": true }, - "gcp_workload_identity_federation_source": { + "azure_use_managed_identity": { + "type": "boolean", + "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", + "default": false + }, + "gcp_metadata_url": { "type": "string", - "enum": [ - "aws_iam", - "off" - ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." + "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "x-referenceable": true }, "header_value": { "type": "string", @@ -193,54 +105,42 @@ "x-referenceable": true, "x-encrypted": true }, - "param_value": { - "type": "string", - "description": "Specify the full parameter value for 'param_name'.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_use_managed_identity": { - "type": "boolean", - "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", - "default": false - }, - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false - }, - "gcp_oauth_token_url": { + "param_location": { "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", - "x-referenceable": true + "enum": [ + "body", + "query" + ], + "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." }, - "aws_access_key_id": { + "azure_client_secret": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", "x-referenceable": true, "x-encrypted": true }, - "aws_session_token": { + "aws_secret_access_key": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", "x-referenceable": true, "x-encrypted": true }, "gcp_workload_identity_federation_auth_json": { "type": "string", "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, - "param_name": { + "gcp_oauth_token_url": { "type": "string", - "description": "If AI model requires authentication via query parameter, specify its name here.", + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", "x-referenceable": true }, - "azure_tenant_id": { + "aws_session_token": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", - "x-referenceable": true + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "x-referenceable": true, + "x-encrypted": true } } }, @@ -284,61 +184,62 @@ "options": { "type": "object", "properties": { - "dashscope": { - "type": "object", - "properties": { - "international": { - "type": "boolean", - "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", - "default": true - } - } + "context_window_factor": { + "type": "array", + "items": { + "type": "object", + "properties": { + "above": { + "type": "string" + }, + "input_factor": { + "type": "number" + }, + "output_factor": { + "type": "number" + } + }, + "required": [ + "above", + "input_factor", + "output_factor" + ] + }, + "description": "Above an input-token threshold, scale input/output pricing with the corresponding factor." }, - "input_cost": { + "temperature": { "type": "number", - "description": "Defines the cost per 1M tokens in your prompt." + "maximum": 5, + "minimum": 0, + "description": "Defines the matching temperature, if using chat or completion models." }, - "cache_read_cost": { - "type": "number", - "description": "Defines the cost per 1M cache-read (cached) prompt tokens." + "azure_service": { + "type": "string", + "enum": [ + "azure-foundry", + "azure-openai" + ], + "description": "Service type for Azure provider models.", + "default": "azure-openai" }, - "azure_instance": { + "azure_api_version": { "type": "string", - "description": "Instance name for Azure OpenAI hosted models." + "description": "'api-version' for Azure OpenAI instances.", + "default": "2023-05-15" }, - "cohere": { + "upstream_url": { + "type": "string", + "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." + }, + "dashscope": { "type": "object", "properties": { - "wait_for_model": { + "international": { "type": "boolean", - "description": "Wait for the model if it is not ready" - }, - "api_version": { - "type": "string", - "enum": [ - "v1", - "v2" - ], - "description": "Cohere API version for chat route type: v1 (legacy, /v1/chat) or v2 (default, /v2/chat, supports tools).", - "default": "v2" - }, - "embedding_input_type": { - "type": "string", - "enum": [ - "classification", - "clustering", - "image", - "search_document", - "search_query" - ], - "description": "The purpose of the input text to calculate embedding vectors.", - "default": "classification" - } - } - }, - "embeddings_dimensions": { - "type": "integer", - "description": "If using embeddings models, set the number of dimensions to generate." + "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", + "default": true + } + } }, "bedrock": { "type": "object", @@ -351,155 +252,89 @@ "type": "string", "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." }, - "batch_role_arn": { - "type": "string", - "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." - }, "aws_region": { "type": "string", "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." }, - "aws_assume_role_arn": { + "aws_role_session_name": { "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." }, "aws_sts_endpoint_url": { "type": "string", "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." }, - "aws_role_session_name": { - "type": "string", - "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." - }, "embeddings_normalize": { "type": "boolean", "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", "default": false }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." - } - } - }, - "azure_foundry_path_prefix": { - "type": "string", - "enum": [ - "/anthropic/v1", - "/openai/v1" - ], - "description": "Path prefix for Azure Foundry hosted models.", - "default": "/openai/v1" - }, - "sagemaker": { - "type": "object", - "properties": { - "target_container_hostname": { - "type": "string", - "description": "Sets the X-Amzn-SageMaker-Target-Container-Hostname header for multi-container endpoints." - }, - "aws_region": { + "batch_role_arn": { "type": "string", - "description": "Override the `AWS_REGION` environment variable for SageMaker requests." + "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." }, "aws_assume_role_arn": { "type": "string", - "description": "Assume a different IAM role after authentication." - }, - "aws_role_session_name": { - "type": "string", - "description": "Identifier for the assumed role session." - }, - "aws_sts_endpoint_url": { - "type": "string", - "description": "Override the STS endpoint URL when assuming a different role." - }, - "target_model": { - "type": "string", - "description": "Sets the X-Amzn-SageMaker-Target-Model header for multi-model endpoints." + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." }, - "target_variant": { + "performance_config_latency": { "type": "string", - "description": "Sets the X-Amzn-SageMaker-Target-Variant header for A/B variant testing." + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." } } }, - "service_tier_factor": { - "type": "array", - "items": { - "type": "object", - "properties": { - "tier": { - "type": "string", - "minLength": 1, - "description": "A word matched case-insensitively as a substring of the vendor's reported service tier (e.g. 'priority', 'flex', or 'throughput' for Gemini/Vertex's PROVISIONED_THROUGHPUT). If several entries match, the longest (most specific) wins; array order doesn't matter. Configure 'priority' will also match 'fast' (whole word) as OpenAI returns either 'priority' or 'fast' for priority service tier." - }, - "factor": { - "type": "number" - } - }, - "required": [ - "factor", - "tier" - ] - }, - "description": "Multiplier applied to the whole request for a service tier. No need to configure a standard/default tier, as the default factor is 1.0 if none of the tier is matched." + "max_tokens": { + "type": "integer", + "description": "Defines the max_tokens, if using chat or completion models." }, - "anthropic_version": { - "type": "string", - "description": "Defines the schema/API version, if using Anthropic provider." + "output_cost": { + "type": "number", + "description": "Defines the cost per 1M tokens in the output of the AI." }, - "mistral_format": { - "type": "string", - "enum": [ - "ollama", - "openai" - ], - "description": "If using mistral provider, select the upstream message format." + "top_k": { + "type": "integer", + "maximum": 500, + "minimum": 0, + "description": "Defines the top-k most likely tokens, if supported." }, - "databricks": { + "cohere": { "type": "object", "properties": { - "workspace_instance_id": { + "embedding_input_type": { "type": "string", - "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." + "enum": [ + "classification", + "clustering", + "image", + "search_document", + "search_query" + ], + "description": "The purpose of the input text to calculate embedding vectors.", + "default": "classification" + }, + "wait_for_model": { + "type": "boolean", + "description": "Wait for the model if it is not ready" + }, + "api_version": { + "type": "string", + "enum": [ + "v1", + "v2" + ], + "description": "Cohere API version for chat route type: v1 (legacy, /v1/chat) or v2 (default, /v2/chat, supports tools).", + "default": "v2" } } }, - "max_tokens": { - "type": "integer", - "description": "Defines the max_tokens, if using chat or completion models." - }, - "input_cost_list": { + "cache_read_cost_list": { "type": "array", "items": { "type": "object", "properties": { - "modal": { - "type": "string", - "enum": [ - "audio", - "image", - "text", - "video" - ] - }, "cost": { "type": "number" - } - }, - "required": [ - "cost", - "modal" - ] - }, - "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." - }, - "cache_read_cost_list": { - "type": "array", - "items": { - "type": "object", - "properties": { + }, "modal": { "type": "string", "enum": [ @@ -508,9 +343,6 @@ "text", "video" ] - }, - "cost": { - "type": "number" } }, "required": [ @@ -520,34 +352,67 @@ }, "description": "Per-modality override of `cache_read_cost`, in cost per 1M cache-read prompt tokens. Set it for models that price each modality separately." }, - "top_k": { - "type": "integer", - "maximum": 500, + "top_p": { + "type": "number", + "maximum": 1, "minimum": 0, - "description": "Defines the top-k most likely tokens, if supported." - }, - "azure_foundry_resource": { - "type": "string", - "description": "Resource name for Azure Foundry hosted models." + "description": "Defines the top-p probability mass, if supported." }, "azure_foundry_domain": { "type": "string", "description": "Domain for Azure Foundry hosted models.", "default": "services.ai.azure.com" }, - "kimi": { + "databricks": { "type": "object", "properties": { - "international": { - "type": "boolean", - "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", - "default": true + "workspace_instance_id": { + "type": "string", + "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." } } }, - "output_cost": { - "type": "number", - "description": "Defines the cost per 1M tokens in the output of the AI." + "azure_foundry_path_prefix": { + "type": "string", + "enum": [ + "/anthropic/v1", + "/openai/v1" + ], + "description": "Path prefix for Azure Foundry hosted models.", + "default": "/openai/v1" + }, + "sagemaker": { + "type": "object", + "properties": { + "aws_region": { + "type": "string", + "description": "Override the `AWS_REGION` environment variable for SageMaker requests." + }, + "aws_assume_role_arn": { + "type": "string", + "description": "Assume a different IAM role after authentication." + }, + "aws_role_session_name": { + "type": "string", + "description": "Identifier for the assumed role session." + }, + "aws_sts_endpoint_url": { + "type": "string", + "description": "Override the STS endpoint URL when assuming a different role." + }, + "target_model": { + "type": "string", + "description": "Sets the X-Amzn-SageMaker-Target-Model header for multi-model endpoints." + }, + "target_variant": { + "type": "string", + "description": "Sets the X-Amzn-SageMaker-Target-Variant header for A/B variant testing." + }, + "target_container_hostname": { + "type": "string", + "description": "Sets the X-Amzn-SageMaker-Target-Container-Hostname header for multi-container endpoints." + } + } }, "output_cost_list": { "type": "array", @@ -574,46 +439,63 @@ }, "description": "Per-modality override of `output_cost`, in cost per 1M output tokens. Set it for models that price each modality separately." }, - "context_window_factor": { + "service_tier_factor": { "type": "array", "items": { "type": "object", "properties": { - "above": { - "type": "string" - }, - "input_factor": { - "type": "number" + "tier": { + "type": "string", + "minLength": 1, + "description": "A word matched case-insensitively as a substring of the vendor's reported service tier (e.g. 'priority', 'flex', or 'throughput' for Gemini/Vertex's PROVISIONED_THROUGHPUT). If several entries match, the longest (most specific) wins; array order doesn't matter. Configure 'priority' will also match 'fast' (whole word) as OpenAI returns either 'priority' or 'fast' for priority service tier." }, - "output_factor": { + "factor": { "type": "number" } }, - "required": [ - "above", - "input_factor", - "output_factor" - ] - }, - "description": "Above an input-token threshold, scale input/output pricing with the corresponding factor." + "required": [ + "factor", + "tier" + ] + }, + "description": "Multiplier applied to the whole request for a service tier. No need to configure a standard/default tier, as the default factor is 1.0 if none of the tier is matched." + }, + "gemini": { + "type": "object", + "properties": { + "api_endpoint": { + "type": "string", + "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." + }, + "project_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the project ID." + }, + "location_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the location ID." + }, + "endpoint_id": { + "type": "string", + "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." + } + } }, - "azure_service": { + "azure_instance": { "type": "string", - "enum": [ - "azure-foundry", - "azure-openai" - ], - "description": "Service type for Azure provider models.", - "default": "azure-openai" + "description": "Instance name for Azure OpenAI hosted models." }, - "azure_api_version": { + "azure_deployment_id": { "type": "string", - "description": "'api-version' for Azure OpenAI instances.", - "default": "2023-05-15" + "description": "Deployment ID for Azure OpenAI instances." }, - "upstream_url": { - "type": "string", - "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." + "embeddings_dimensions": { + "type": "integer", + "description": "If using embeddings models, set the number of dimensions to generate." + }, + "input_cost": { + "type": "number", + "description": "Defines the cost per 1M tokens in your prompt." }, "cache_write_cost": { "type": "number", @@ -638,21 +520,9 @@ }, "description": "Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this if the upstream provider charges differently for different cache TTLs, as Anthropic does for 5m and 1h TTLs." }, - "temperature": { - "type": "number", - "maximum": 5, - "minimum": 0, - "description": "Defines the matching temperature, if using chat or completion models." - }, - "top_p": { - "type": "number", - "maximum": 1, - "minimum": 0, - "description": "Defines the top-p probability mass, if supported." - }, - "azure_deployment_id": { + "anthropic_version": { "type": "string", - "description": "Deployment ID for Azure OpenAI instances." + "description": "Defines the schema/API version, if using Anthropic provider." }, "llama2_format": { "type": "string", @@ -663,27 +533,28 @@ ], "description": "If using llama2 provider, select the upstream message format." }, - "gemini": { + "kimi": { "type": "object", "properties": { - "api_endpoint": { - "type": "string", - "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." - }, - "project_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the project ID." - }, - "location_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the location ID." - }, - "endpoint_id": { - "type": "string", - "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." + "international": { + "type": "boolean", + "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", + "default": true } } }, + "azure_foundry_resource": { + "type": "string", + "description": "Resource name for Azure Foundry hosted models." + }, + "mistral_format": { + "type": "string", + "enum": [ + "ollama", + "openai" + ], + "description": "If using mistral provider, select the upstream message format." + }, "huggingface": { "type": "object", "properties": { @@ -696,6 +567,35 @@ "description": "Use the cache layer on the inference API" } } + }, + "cache_read_cost": { + "type": "number", + "description": "Defines the cost per 1M cache-read (cached) prompt tokens." + }, + "input_cost_list": { + "type": "array", + "items": { + "type": "object", + "properties": { + "modal": { + "type": "string", + "enum": [ + "audio", + "image", + "text", + "video" + ] + }, + "cost": { + "type": "number" + } + }, + "required": [ + "cost", + "modal" + ] + }, + "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." } }, "description": "Key/value settings for the model" @@ -746,37 +646,137 @@ "description": "For internal use only. ", "nullable": true, "x-speakeasy-type-override": "any" + }, + "route_type": { + "type": "string", + "enum": [ + "audio/v1/audio/speech", + "audio/v1/audio/transcriptions", + "audio/v1/audio/translations", + "image/v1/images/edits", + "image/v1/images/generations", + "llm/v1/assistants", + "llm/v1/batches", + "llm/v1/chat", + "llm/v1/completions", + "llm/v1/embeddings", + "llm/v1/files", + "llm/v1/responses", + "llm/v1/skills", + "passthrough", + "realtime/v1/realtime", + "video/v1/videos/generations" + ], + "description": "The model's operation implementation, for this provider. " } }, "required": [ "model", "route_type" ] + }, + "message_countback": { + "type": "number", + "maximum": 1000, + "minimum": 1, + "description": "Number of messages in the chat history to use for evaluating the request", + "default": 1 + }, + "ignore_system_prompts": { + "type": "boolean", + "description": "Ignore and discard any system prompts when evaluating the request", + "default": true + }, + "ignore_assistant_prompts": { + "type": "boolean", + "description": "Ignore and discard any assistant prompts when evaluating the request", + "default": true + }, + "score_header_name": { + "type": "string", + "description": "Name of the response header used to expose the judge score.", + "default": "X-Kong-LLM-Accuracy-Score" + }, + "prompt": { + "type": "string", + "description": "Use this prompt to tune the LLM system/assistant message for the llm as a judge prompt.", + "default": "You are a strict evaluator. You will be given a prompt and a response. Your task is to judge whether the response is correct or incorrect. You must assign a score between 1 and 100, where: 100 represents a completely correct and ideal response, 1 represents a completely incorrect or irrelevant response. Your score must be a single number only — no text, labels, or explanations. Use the full range of values (e.g., 13, 47, 86), not just round numbers like 10, 50, or 100. Be accurate and consistent, as this score will be used by another model for learning and evaluation." + }, + "ignore_tool_prompts": { + "type": "boolean", + "description": "Ignore and discard any tool prompts when evaluating the request", + "default": true + }, + "http_timeout": { + "type": "integer", + "description": "Timeout in milliseconds for the AI upstream service.", + "default": 60000 + }, + "https_verify": { + "type": "boolean", + "description": "Verify the TLS certificate of the AI upstream service.", + "default": true + }, + "sampling_rate": { + "type": "number", + "maximum": 1, + "minimum": 0, + "description": "Judging request sampling rate for configuring the probability-based sampler.", + "default": 1 + }, + "proxy_config": { + "type": "object", + "properties": { + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" + }, + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + } + } } }, "required": [ "llm" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/AiMcpOauth2.json b/app/_schemas/ai-gateway/policies/AiMcpOauth2.json index 65c0dac6e58..bb7c8f85eed 100644 --- a/app/_schemas/ai-gateway/policies/AiMcpOauth2.json +++ b/app/_schemas/ai-gateway/policies/AiMcpOauth2.json @@ -22,6 +22,11 @@ "config": { "type": "object", "properties": { + "max_request_body_size": { + "type": "integer", + "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", + "default": 8388608 + }, "authorization_servers": { "type": "array", "items": { @@ -30,65 +35,52 @@ }, "minLength": 1 }, - "consumer_groups_optional": { - "type": "boolean", - "description": "Do not terminate the request if consumer groups mapping fails.", - "default": false - }, - "proxy_config": { - "type": "object", - "properties": { - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "proxy_scheme": { - "type": "string", - "enum": [ - "http" - ], - "description": "The proxy scheme to use when connecting. Only `http` is supported.", - "default": "http" - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true + "claim_to_header": { + "type": "array", + "items": { + "type": "object", + "properties": { + "header": { + "type": "string", + "description": "The HTTP header name to be used for forwarding the claim value to the upstream." + }, + "claim": { + "type": "string", + "description": "The claim name to be used in the access token." + } }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - } - } + "required": [ + "claim", + "header" + ] + }, + "minLength": 1, + "description": "Map top-level token claims to upstream headers. Mutually exclusive with upstream_headers." }, - "client_secret": { + "metadata_cache_ttl": { + "type": "integer", + "description": "The cache TTL in seconds for discovered authorization server metadata.", + "default": 3600 + }, + "introspection_endpoint": { "type": "string", - "description": "The client secret for authentication.", - "x-encrypted": true, + "description": "The Token Introspection Endpoint. If not provided, the policy will attempt to use JWKS to verify the token. If the token is opaque, this field must be provided." + }, + "client_id": { + "type": "string", + "description": "The client ID for authentication.", "x-referenceable": true }, + "tls_client_auth_ssl_verify": { + "type": "boolean", + "description": "Verify server certificate in mTLS.", + "default": true + }, + "timeout": { + "type": "number", + "description": "Network I/O timeout in milliseconds.", + "default": 10000 + }, "client_auth": { "type": "string", "enum": [ @@ -102,6 +94,22 @@ ], "description": "The client authentication method." }, + "tls_client_auth_cert": { + "type": "string", + "description": "PEM-encoded client certificate for mTLS." + }, + "args": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Additional arguments to send in the POST body." + }, + "http_version": { + "type": "number", + "description": "The HTTP version used for requests.", + "default": 1.1 + }, "introspection_format": { "type": "string", "enum": [ @@ -111,19 +119,30 @@ ], "description": "Controls introspection response format." }, - "resource": { - "type": "string", - "description": "The resource identifier." - }, - "expected_audience": { - "type": "string", - "minLength": 1, - "description": "The expected `aud` claim value for access token audience validation. When unset, the policy expects `config.resource`. When `config.insecure_relaxed_audience_validation` is `true`, audience validation is disabled and this field is ignored." - }, - "passthrough_credentials": { - "type": "boolean", - "description": "Keep the credentials used for authentication in the request. If multiple credentials are sent with the same request, the policy will keep those that were used for successful authentication.", - "default": false + "upstream_headers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "header": { + "type": "string", + "description": "The name of the header." + }, + "path": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "The path of the header value." + } + }, + "required": [ + "header", + "path" + ] + }, + "description": "Map token claims to upstream headers using path-based access. Each entry specifies a header name and a path (array of strings) to traverse the token claims. Mutually exclusive with claim_to_header." }, "consumer_groups_claim": { "type": "array", @@ -133,17 +152,82 @@ "minLength": 1, "description": "The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload." }, + "cache_introspection": { + "type": "boolean", + "description": "If enabled, the policy will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server.", + "default": true + }, + "metadata_discovery_retry": { + "type": "integer", + "description": "The number of retry attempts for metadata discovery requests per URL.", + "default": 3 + }, + "proxy_config": { + "type": "object", + "properties": { + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" + }, + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-encrypted": true, + "x-referenceable": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + } + } + }, + "consumer_groups_optional": { + "type": "boolean", + "description": "Do not terminate the request if consumer groups mapping fails.", + "default": false + }, + "insecure_relaxed_audience_validation": { + "type": "boolean", + "description": "If enabled, the policy will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification.", + "default": false + }, "jwks_endpoint": { "type": "string", "description": "The JWKS endpoint URL for fetching the authorization server's public keys. If not provided, the policy will attempt to discover it from the authorization server metadata." }, - "introspection_endpoint": { - "type": "string", - "description": "The Token Introspection Endpoint. If not provided, the policy will attempt to use JWKS to verify the token. If the token is opaque, this field must be provided." - }, - "mtls_introspection_endpoint": { - "type": "string", - "description": "The mTLS alias for the introspection endpoint." + "jwks_cache_ttl": { + "type": "integer", + "description": "The cache TTL in seconds for JWKS.", + "default": 3600 }, "client_alg": { "type": "string", @@ -159,80 +243,24 @@ "PS384", "PS512", "RS256", - "RS384", - "RS512" - ], - "description": "The client JWT signing algorithm." - }, - "max_request_body_size": { - "type": "integer", - "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", - "default": 8388608 - }, - "jwks_cache_ttl": { - "type": "integer", - "description": "The cache TTL in seconds for JWKS.", - "default": 3600 - }, - "tls_client_auth_key": { - "type": "string", - "description": "PEM-encoded private key for mTLS." - }, - "args": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Additional arguments to send in the POST body." - }, - "timeout": { - "type": "number", - "description": "Network I/O timeout in milliseconds.", - "default": 10000 - }, - "scopes_supported": { - "type": "array", - "items": { - "type": "string", - "description": "Recommended scopes that are used in authorization requests to request access to this protected resource." - }, - "minLength": 1 - }, - "consumer_optional": { - "type": "boolean", - "description": "Do not terminate the request if consumer mapping fails.", - "default": false - }, - "insecure_relaxed_audience_validation": { - "type": "boolean", - "description": "If enabled, the policy will not validate the audience of the access token. Disable it if the authorization server does not correctly set the audience claim according to RFC 8707 and MCP specification.", - "default": false - }, - "client_id": { - "type": "string", - "description": "The client ID for authentication.", - "x-referenceable": true - }, - "headers": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Additional headers for the introspection request." + "RS384", + "RS512" + ], + "description": "The client JWT signing algorithm." }, "ssl_verify": { "type": "boolean", "description": "Verify the SSL certificate.", "default": true }, - "http_version": { - "type": "number", - "description": "The HTTP version used for requests.", - "default": 1.1 - }, - "metadata_endpoint": { + "resource": { "type": "string", - "description": "The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource." + "description": "The resource identifier." + }, + "consumer_optional": { + "type": "boolean", + "description": "Do not terminate the request if consumer mapping fails.", + "default": false }, "credential_claim": { "type": "array", @@ -244,120 +272,34 @@ "sub" ] }, + "mtls_introspection_endpoint": { + "type": "string", + "description": "The mTLS alias for the introspection endpoint." + }, + "headers": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Additional headers for the introspection request." + }, "metadata_discovery_endpoint": { "type": "string", "description": "Custom OAuth 2.0 authorization server metadata discovery URL. If provided, the policy will use this URL directly instead of trying standard well-known discovery paths. The custom endpoint URL should end with either '/.well-known/openid-configuration' or '/.well-known/oauth-authorization-server'." }, - "metadata_cache_ttl": { - "type": "integer", - "description": "The cache TTL in seconds for discovered authorization server metadata.", - "default": 3600 - }, "client_jwk": { "type": "string", "description": "The client JWK for private_key_jwt authentication.", "x-referenceable": true, "x-encrypted": true }, - "metadata_discovery_retry": { - "type": "integer", - "description": "The number of retry attempts for metadata discovery requests per URL.", - "default": 3 - }, - "tls_client_auth_cert": { + "tls_client_auth_key": { "type": "string", - "description": "PEM-encoded client certificate for mTLS." - }, - "claim_to_header": { - "type": "array", - "items": { - "type": "object", - "properties": { - "claim": { - "type": "string", - "description": "The claim name to be used in the access token." - }, - "header": { - "type": "string", - "description": "The HTTP header name to be used for forwarding the claim value to the upstream." - } - }, - "required": [ - "claim", - "header" - ] - }, - "minLength": 1, - "description": "Map top-level token claims to upstream headers. Mutually exclusive with upstream_headers." - }, - "upstream_headers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "path": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "The path of the header value." - }, - "header": { - "type": "string", - "description": "The name of the header." - } - }, - "required": [ - "header", - "path" - ] - }, - "description": "Map token claims to upstream headers using path-based access. Each entry specifies a header name and a path (array of strings) to traverse the token claims. Mutually exclusive with claim_to_header." - }, - "consumer_claim": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "The claim used for consumer mapping. If multiple values are set, it means the claim is inside a nested object of the token payload." - }, - "consumer_by": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "custom_id", - "id", - "username" - ] - }, - "minLength": 1, - "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.", - "default": [ - "custom_id", - "username" - ] + "description": "PEM-encoded private key for mTLS." }, "token_exchange": { "type": "object", "properties": { - "cache": { - "type": "object", - "properties": { - "ttl": { - "type": "integer", - "description": "The default cache TTL to store exchanged token. If the exchange endpoint does not provide 'expires_in' data when token is exchanged this TTL value will be used to cache it.", - "default": 3600 - }, - "enabled": { - "type": "boolean", - "description": "Whether to cache exchanged token", - "default": true - } - } - }, "enabled": { "type": "boolean", "description": "Whether Token Exchange should be enabled", @@ -392,9 +334,27 @@ "request": { "type": "object", "properties": { - "resource": { + "subject_token_type": { "type": "string", - "description": "The absolute URI of target MCP service where token will be used." + "description": "The type of token to be exchanged.", + "default": "urn:ietf:params:oauth:token-type:access_token" + }, + "actor_token_header": { + "type": "string", + "description": "Header name containing actor token (when source is header)." + }, + "actor_token_type": { + "type": "string", + "description": "The token type identifier of actor token.", + "default": "urn:ietf:params:oauth:token-type:access_token" + }, + "audience": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "Audiences used in the token exchange request." }, "scopes": { "type": "array", @@ -404,16 +364,6 @@ "minLength": 1, "description": "Scopes used in the token exchange request." }, - "requested_token_type": { - "type": "string", - "description": "The desired output token type.", - "default": "urn:ietf:params:oauth:token-type:access_token" - }, - "subject_token_type": { - "type": "string", - "description": "The type of token to be exchanged.", - "default": "urn:ietf:params:oauth:token-type:access_token" - }, "actor_token_source": { "type": "string", "enum": [ @@ -428,22 +378,29 @@ "type": "string", "description": "Static actor token value (when source is config)." }, - "actor_token_type": { + "resource": { "type": "string", - "description": "The token type identifier of actor token.", - "default": "urn:ietf:params:oauth:token-type:access_token" - }, - "audience": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "Audiences used in the token exchange request." + "description": "The absolute URI of target MCP service where token will be used." }, - "actor_token_header": { + "requested_token_type": { "type": "string", - "description": "Header name containing actor token (when source is header)." + "description": "The desired output token type.", + "default": "urn:ietf:params:oauth:token-type:access_token" + } + } + }, + "cache": { + "type": "object", + "properties": { + "ttl": { + "type": "integer", + "description": "The default cache TTL to store exchanged token. If the exchange endpoint does not provide 'expires_in' data when token is exchanged this TTL value will be used to cache it.", + "default": 3600 + }, + "enabled": { + "type": "boolean", + "description": "Whether to cache exchanged token", + "default": true } } } @@ -453,24 +410,67 @@ ], "description": "Configuration details about token exchange that should happen before reaching upstream MCP server" }, - "keepalive": { - "type": "boolean", - "description": "Enable HTTP keepalive for requests.", - "default": true + "metadata_endpoint": { + "type": "string", + "description": "The path for OAuth 2.0 Protected Resource Metadata. Default to $resource/.well-known/oauth-protected-resource. For example, if the configured resource is https://api.example.com/mcp, the metadata endpoint is /mcp/.well-known/oauth-protected-resource." }, - "cache_introspection": { + "expected_audience": { + "type": "string", + "minLength": 1, + "description": "The expected `aud` claim value for access token audience validation. When unset, the policy expects `config.resource`. When `config.insecure_relaxed_audience_validation` is `true`, audience validation is disabled and this field is ignored." + }, + "passthrough_credentials": { "type": "boolean", - "description": "If enabled, the policy will cache the introspection response for the access token. This can improve performance by reducing the number of introspection requests to the authorization server.", - "default": true + "description": "Keep the credentials used for authentication in the request. If multiple credentials are sent with the same request, the policy will keep those that were used for successful authentication.", + "default": false + }, + "consumer_claim": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "The claim used for consumer mapping. If multiple values are set, it means the claim is inside a nested object of the token payload." + }, + "scopes_supported": { + "type": "array", + "items": { + "type": "string", + "description": "Recommended scopes that are used in authorization requests to request access to this protected resource." + }, + "minLength": 1 + }, + "consumer_by": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "custom_id", + "id", + "username" + ] + }, + "minLength": 1, + "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.", + "default": [ + "custom_id", + "username" + ] }, "jwt_claims_leeway": { "type": "integer", "description": "The leeway in seconds for JWT claims validation (exp, nbf). This allows tokens that are slightly expired or not yet valid due to clock skew.", "default": 0 }, - "tls_client_auth_ssl_verify": { + "client_secret": { + "type": "string", + "description": "The client secret for authentication.", + "x-encrypted": true, + "x-referenceable": true + }, + "keepalive": { "type": "boolean", - "description": "Verify server certificate in mTLS.", + "description": "Enable HTTP keepalive for requests.", "default": true } }, diff --git a/app/_schemas/ai-gateway/policies/AiMcpProxy.json b/app/_schemas/ai-gateway/policies/AiMcpProxy.json index 76f42c89eb4..56ea2620e94 100644 --- a/app/_schemas/ai-gateway/policies/AiMcpProxy.json +++ b/app/_schemas/ai-gateway/policies/AiMcpProxy.json @@ -33,34 +33,14 @@ ], "description": "The mode of the MCP proxy. Possible values are: 'passthrough-listener', 'conversion-listener', 'conversion-only', 'listener', 'upstream-server'." }, - "default_acl": { - "type": "array", - "items": { - "type": "object", - "properties": { - "scope": { - "type": "string", - "description": "Scope for this default ACL entry (for example: 'tools'). Defaults to 'tools'.", - "default": "tools" - }, - "allow": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly allowed to access this scope." - }, - "deny": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly denied from this scope. `deny` takes precedence over `allow`." - } - }, - "description": "Default ACL entry for the given scope. `deny` has higher precedence than `allow`." - }, - "description": "Optional list of default ACL rules keyed by scope (for example: tools)." + "acl_attribute_type": { + "type": "string", + "enum": [ + "consumer", + "oauth_access_token" + ], + "description": "The type of attributes that ACL is evaluated with. Should only be configured on listener modes, not conversion-only.", + "default": "consumer" }, "consumer_identifier": { "type": "string", @@ -72,408 +52,246 @@ "description": "Which subject type entries in ACL lists refer to for per-consumer matching. Should only be configured on listener modes, not conversion-only.", "default": "username" }, - "max_request_body_size": { - "type": "integer", - "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", - "default": 8388608 + "access_token_claim_field": { + "type": "string", + "minLength": 1, + "description": "The claim in the OAuth2 access token to use as the subject for ACL evaluation when 'acl_attribute_type' is set to 'oauth_access_token'. Nested claim can be fetched by using a jq filter starts with dot, e.g., \".user.email\": https://jqlang.org/manual/#object-identifier-index." }, - "auth": { + "logging": { "type": "object", "properties": { - "provider": { - "type": "string", - "enum": [ - "aws_iam", - "off", - "token_vault" - ], - "description": "Set an upstream authorization provider and mechanism to use, before proxying. Set to `off` to disable upstream authentication.", - "default": "off" + "log_statistics": { + "type": "boolean", + "description": "If enabled, will add mcp metrics into the Kong log policy(s) output.", + "default": false }, - "aws_iam": { - "type": "object", - "properties": { - "sts_endpoint_url": { - "type": "string", - "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." - }, - "aws_access_key_id": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-encrypted": true, - "x-referenceable": true - }, - "aws_session_token": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "bearer_token": { - "type": "string", - "description": "If the target AWS service supports Bearer token auth, you can set this token. This will disable request signing and also will override the AWS_BEARER_TOKEN_BEDROCK environment variable. It will also replace/ignore all settings pertaining to AWS IAM access keys and assumed-roles.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_region": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." - }, - "assume_role_arn": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." - }, - "role_session_name": { - "type": "string", - "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." - } - }, - "description": "Common AWS authentication options." + "log_payloads": { + "type": "boolean", + "description": "If enabled, will log the request and response body into the Kong log policy(s) output.", + "default": false }, - "token_vault": { - "type": "object", - "properties": { - "directory": { - "type": "string", - "description": "Directory name segment of the vault token endpoint." - }, - "provider": { - "type": "string", - "description": "Name of the upstream credential provider registered in the Token Vault directory." - }, - "redis": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, - "cloud_authentication": { - "type": "object", - "properties": { - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_assume_role_arn": { - "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_role_session_name": { - "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_secret": { - "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - } - }, - "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." - }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "sentinel_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - } - } - }, - "encryption_secrets": { - "type": "array", - "items": { + "log_audits": { + "type": "boolean", + "description": "If true, emit audit logs for ACL evaluations.", + "default": false + } + } + }, + "rate_limiting": { + "type": "object", + "properties": { + "limits": { + "type": "array", + "items": { + "type": "object", + "properties": { + "window_size": { + "type": "integer", + "enum": [ + 1, + 60, + 3600, + 86400 + ], + "description": "The window size in seconds. One of: 1 (second), 60 (minute), 3600 (hour), 86400 (day)." + }, + "method": { "type": "string", - "minLength": 8, - "x-referenceable": true, - "x-encrypted": true + "description": "The MCP method this limit applies to, e.g. 'tools/call'." }, - "minLength": 1, - "description": "Secrets used to encrypt exchanged credentials before caching them in Redis. Required when redis is configured. The first secret is used for encryption, while all secrets are tried for decryption to support key rotation." - } + "tool": { + "type": "string", + "description": "The tool name this limit applies to. A limit on the tool's own name also matches the 'ident/name' form Kong uses when it namespaces upstream tools (preserve_upstream_tool_names), provided that prefixed tool is registered. May also be written prefixed to target one client-visible name exactly." + }, + "limit": { + "type": "integer", + "description": "The number of requests allowed per window." + } + }, + "required": [ + "limit", + "window_size" + ] }, - "required": [ - "directory", - "provider" - ], - "description": "Resolve an upstream credential per request via the Kong Token Vault." + "minLength": 1, + "description": "Rate limits applied to the MCP method or tool name of each request. Counters are per-node (strategy 'local'): every gateway node counts and enforces independently." } }, - "description": "Set the provider and its options for authenticating requests before proxying." + "required": [ + "limits" + ] }, - "acl_attribute_type": { - "type": "string", - "enum": [ - "consumer", - "oauth_access_token" - ], - "description": "The type of attributes that ACL is evaluated with. Should only be configured on listener modes, not conversion-only.", - "default": "consumer" + "max_request_body_size": { + "type": "integer", + "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", + "default": 8388608 + }, + "proxy_config": { + "type": "object", + "properties": { + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" + }, + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + } + } + }, + "default_acl": { + "type": "array", + "items": { + "type": "object", + "properties": { + "allow": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly allowed to access this scope." + }, + "deny": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly denied from this scope. `deny` takes precedence over `allow`." + }, + "scope": { + "type": "string", + "description": "Scope for this default ACL entry (for example: 'tools'). Defaults to 'tools'.", + "default": "tools" + } + }, + "description": "Default ACL entry for the given scope. `deny` has higher precedence than `allow`." + }, + "description": "Optional list of default ACL rules keyed by scope (for example: tools)." }, "include_consumer_groups": { "type": "boolean", "description": "If enabled (true), allows Consumer Group names to be used in default and per-primitive ACL. Should only be configured on listener modes, not conversion-only.", "default": false }, - "access_token_claim_field": { - "type": "string", - "minLength": 1, - "description": "The claim in the OAuth2 access token to use as the subject for ACL evaluation when 'acl_attribute_type' is set to 'oauth_access_token'. Nested claim can be fetched by using a jq filter starts with dot, e.g., \".user.email\": https://jqlang.org/manual/#object-identifier-index." - }, "tools": { "type": "array", "items": { "type": "object", "properties": { - "input_schema": { + "method": { + "type": "string", + "enum": [ + "DELETE", + "GET", + "PATCH", + "POST", + "PUT" + ], + "description": "The method of the exported API, which must be one of the route's method. By default, Kong will extract the method from API configuration. If the configured method is not exactly matched, this field is required." + }, + "description": { + "type": "string", + "description": "The description of the MCP tool. This is used to provide information about the tool's functionality and usage. Required in conversion-listener and conversion-only modes." + }, + "responses": { "type": "object", "additionalProperties": true, - "description": "The entire inputSchema section for the tool. This will override the upstream server's inputSchema on the same tool name, if present.", + "description": "The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{\"200\":{\"content\":{\"application/json\":{\"schema\":{\"type\":\"object\",\"properties\":{\"result\":{\"type\":\"string\"}}}}}}}'.See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details.Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported.", "nullable": true, "x-speakeasy-type-override": "any" }, - "path": { + "host": { "type": "string", - "description": "The path of the exported API, which must match the route's paths. Path not starting with '/' are treated as relative path and the route path will be added as the prefix. If the upstream path is different from the route one, to match the route's path, use relative path and strip_path to strip the added prefix. Relative path is unsupported when the route path is regex. By default, Kong will extract the path from API configuration." + "description": "The host of the exported API, which must match the route's hosts. It should be the route's host. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required." }, - "headers": { + "request_body": { "type": "object", - "additionalProperties": { - "type": "array", - "items": { - "type": "string" - } - }, - "description": "The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required." + "additionalProperties": true, + "description": "The API requestBody specification defined in OpenAPI JSON format. For example, '{\"content\":{\"application/x-www-form-urlencoded\":{\"schema\":{\"type\":\"object\",\"properties\":{\"color\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}}}}}'.See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported so we need to inline the schema.", + "nullable": true, + "x-speakeasy-type-override": "any" }, - "query": { + "annotations": { "type": "object", - "additionalProperties": { - "type": "array", - "items": { - "type": "string" + "properties": { + "title": { + "type": "string", + "description": "Human-readable title for the tool" + }, + "read_only_hint": { + "type": "boolean", + "description": "If true, the tool does not modify its environment" + }, + "destructive_hint": { + "type": "boolean", + "description": "If true, the tool may perform destructive updates" + }, + "idempotent_hint": { + "type": "boolean", + "description": "If true, repeated calls with same args have no additional effect" + }, + "open_world_hint": { + "type": "boolean", + "description": "If true, tool interacts with external entities" } - }, - "description": "The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required." + } }, - "method": { + "output_schema": { + "type": "object", + "additionalProperties": true, + "description": "The entire outputSchema section for the tool. This will override the upstream server's outputSchema on the same tool name, if present.", + "nullable": true, + "x-speakeasy-type-override": "any" + }, + "scheme": { "type": "string", "enum": [ - "DELETE", - "GET", - "PATCH", - "POST", - "PUT" + "http", + "https" ], - "description": "The method of the exported API, which must be one of the route's method. By default, Kong will extract the method from API configuration. If the configured method is not exactly matched, this field is required." + "description": "The scheme of the exported API, which must be one of the route's scheme. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it." + }, + "input_schema": { + "type": "object", + "additionalProperties": true, + "description": "The entire inputSchema section for the tool. This will override the upstream server's inputSchema on the same tool name, if present.", + "nullable": true, + "x-speakeasy-type-override": "any" }, "name": { "type": "string", @@ -489,92 +307,51 @@ "description": "The API parameters specification defined in OpenAPI JSON format. For example, '[{\"name\": \"city\", \"in\": \"query\", \"description\": \"Name of the city to get the weather for\", \"required\": true, \"schema\": {\"type\": \"string\"}}]'.See https://swagger.io/docs/specification/v3_0/describing-parameters/ for more details.", "nullable": true }, - "scheme": { + "path": { "type": "string", - "enum": [ - "http", - "https" - ], - "description": "The scheme of the exported API, which must be one of the route's scheme. By default, Kong will extract the scheme from API configuration. If the configured scheme is not expected, this field can be used to override it." + "description": "The path of the exported API, which must match the route's paths. Path not starting with '/' are treated as relative path and the route path will be added as the prefix. If the upstream path is different from the route one, to match the route's path, use relative path and strip_path to strip the added prefix. Relative path is unsupported when the route path is regex. By default, Kong will extract the path from API configuration." }, - "acl": { + "headers": { "type": "object", - "properties": { - "allow": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly allowed to use this primitive." - }, - "deny": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly denied from using this primitive. `deny` takes precedence over `allow`." + "additionalProperties": { + "type": "array", + "items": { + "type": "string" } }, - "description": "Optional per-primitive ACL. `deny` has higher precedence than `allow`." - }, - "description": { - "type": "string", - "description": "The description of the MCP tool. This is used to provide information about the tool's functionality and usage." - }, - "request_body": { - "type": "object", - "additionalProperties": true, - "description": "The API requestBody specification defined in OpenAPI JSON format. For example, '{\"content\":{\"application/x-www-form-urlencoded\":{\"schema\":{\"type\":\"object\",\"properties\":{\"color\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}}}}}'.See https://swagger.io/docs/specification/v3_0/describing-request-body/describing-request-body/ for more details. Note that `$ref` is not supported so we need to inline the schema.", - "nullable": true, - "x-speakeasy-type-override": "any" - }, - "responses": { - "type": "object", - "additionalProperties": true, - "description": "The API responses specification defined in OpenAPI JSON format. This specification will be used to validate the upstream response and map it back to the structuredOutput. For example, '{\"200\":{\"content\":{\"application/json\":{\"schema\":{\"type\":\"object\",\"properties\":{\"result\":{\"type\":\"string\"}}}}}}}'.See https://swagger.io/docs/specification/v3_0/describing-responses/ for more details.Only one non-error (status code < 400) response is supported. Note that `$ref` is not supported.", - "nullable": true, - "x-speakeasy-type-override": "any" - }, - "host": { - "type": "string", - "description": "The host of the exported API, which must match the route's hosts. It should be the route's host. By default, Kong will extract the host from API configuration. If the configured host is wildcard, this field is required." + "description": "The headers of the exported API. By default, Kong will extract the headers from API configuration. If the configured headers are not exactly matched, this field is required." }, - "output_schema": { + "query": { "type": "object", - "additionalProperties": true, - "description": "The entire outputSchema section for the tool. This will override the upstream server's outputSchema on the same tool name, if present.", - "nullable": true, - "x-speakeasy-type-override": "any" + "additionalProperties": { + "type": "array", + "items": { + "type": "string" + } + }, + "description": "The query arguments of the exported API. If the generated query arguments are not exactly matched, this field is required." }, - "annotations": { + "acl": { "type": "object", "properties": { - "title": { - "type": "string", - "description": "Human-readable title for the tool" - }, - "read_only_hint": { - "type": "boolean", - "description": "If true, the tool does not modify its environment" - }, - "destructive_hint": { - "type": "boolean", - "description": "If true, the tool may perform destructive updates" - }, - "idempotent_hint": { - "type": "boolean", - "description": "If true, repeated calls with same args have no additional effect" + "allow": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly allowed to use this primitive." }, - "open_world_hint": { - "type": "boolean", - "description": "If true, tool interacts with external entities" + "deny": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Subjects (e.g. Consumer name, Consumer Groups, or Claim values depending on configuration) explicitly denied from using this primitive. `deny` takes precedence over `allow`." } - } + }, + "description": "Optional per-primitive ACL. `deny` has higher precedence than `allow`." } - }, - "required": [ - "description" - ] + } } }, "server": { @@ -585,9 +362,115 @@ "description": "The timeout for calling the tools in milliseconds.", "default": 10000 }, + "allowed_versions": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "2025-03-26", + "2025-06-18", + "2025-11-25", + "2026-07-28" + ] + }, + "minLength": 1, + "description": "The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong implements, which is the default. When set, `server/discover` advertises exactly this list and a request declaring anything else is rejected with `-32022`. Listing only per-request revisions refuses handshake clients." + }, + "cache": { + "type": "object", + "properties": { + "tools_list": { + "type": "object", + "properties": { + "ttl_ms": { + "type": "integer", + "description": "How long a client may treat a 'tools/list' result as fresh, in milliseconds." + }, + "cache_scope": { + "type": "string", + "enum": [ + "private", + "public" + ], + "description": "Whether a 'tools/list' result may be cached across authorization contexts.", + "default": "private" + } + } + }, + "discover": { + "type": "object", + "properties": { + "ttl_ms": { + "type": "integer", + "description": "How long a client may treat a 'server/discover' result as fresh, in milliseconds." + }, + "cache_scope": { + "type": "string", + "enum": [ + "private", + "public" + ], + "description": "Whether a 'server/discover' result may be cached across authorization contexts.", + "default": "private" + } + } + } + }, + "description": "Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them." + }, + "tools_list_auth": { + "type": "object", + "properties": { + "id_token_header": { + "type": "string", + "description": "Specify a header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave this empty to not send the ID token during tools list." + }, + "token_endpoint": { + "type": "string", + "description": "The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials.", + "x-referenceable": true + }, + "client_id": { + "type": "string", + "description": "The client ID for the OAuth 2.0 client-credentials.", + "x-referenceable": true, + "x-encrypted": true + }, + "client_secret": { + "type": "string", + "description": "The client secret for the OAuth 2.0 client-credentials.", + "x-referenceable": true, + "x-encrypted": true + }, + "scope": { + "type": "string", + "description": "The scopes for the OAuth 2.0 client-credentials.", + "x-referenceable": true + }, + "access_token_header": { + "type": "string", + "description": "Specify a header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Defaults to 'Authorization'." + } + }, + "description": "Provide OAuth 2.0 client-credentials that can be used for fetching the tools list from an upstream MCP server. This is only applicable when mode is 'upstream-server'. The credentials will be stored in Kong and sent to the upstream MCP server when fetching the tools list." + }, + "tag": { + "type": "string", + "description": "The tag of the MCP server. This is used to filter the exported MCP tools. The field should contain exactly one tag. " + }, + "forward_client_headers": { + "type": "boolean", + "description": "Whether to forward the client request headers to the upstream server when calling the tools.", + "default": true + }, "session": { "type": "object", "properties": { + "managed": { + "type": "boolean", + "description": "If enabled, Kong will maintain managed sessions with the MCP server.", + "default": true + }, "session_ttl": { "type": "number", "description": "The time-to-live (TTL) for each session in seconds.", @@ -609,8 +492,8 @@ "items": { "type": "string", "minLength": 8, - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, "minLength": 1, "description": "The secrets that are used in session encryption. Required when the strategy is 'client'. The first secret is used for encryption, while all secrets are used for decryption to support key rotation." @@ -625,36 +508,6 @@ "type": "string", "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, "sentinel_nodes": { "type": "array", "items": { @@ -674,19 +527,106 @@ } } }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "cloud_authentication": { + "type": "object", + "properties": { + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "auth_provider": { + "type": "string", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true + } + }, + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "database": { + "keepalive_backlog": { "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." }, "cluster_nodes": { "type": "array", @@ -710,352 +650,502 @@ "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "ssl": { + "ssl_verify": { "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true }, "cluster_max_redirections": { "type": "integer", "description": "Maximum retry attempts for redirection.", "default": 5 }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "keepalive_pool_size": { + "port": { "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true }, - "keepalive_backlog": { + "read_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, - "send_timeout": { + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "connect_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, "password": { "type": "string", "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", "x-referenceable": true, "x-encrypted": true }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, "sentinel_username": { "type": "string", "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "cloud_authentication": { + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + } + } + } + }, + "description": "Enable managed session when Kong responds as MCP server in listener or conversion-listener modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers." + }, + "preserve_upstream_tool_names": { + "type": "boolean", + "description": "If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server. If disabled (false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used.", + "default": false + }, + "upstream_protocol_version": { + "type": "string", + "enum": [ + "2025-03-26", + "2025-06-18", + "2025-11-25", + "2026-07-28" + ], + "description": "The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to negotiate a handshake revision with an `initialize` exchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session." + } + } + }, + "tools_cache_ttl_seconds": { + "type": "integer", + "description": "The time-to-live (TTL) for the upstream tools cache in seconds. Set to 0 to refresh on every client call." + }, + "auth": { + "type": "object", + "properties": { + "provider": { + "type": "string", + "enum": [ + "aws_iam", + "off", + "token_vault" + ], + "description": "Set an upstream authorization provider and mechanism to use, before proxying. Set to `off` to disable upstream authentication.", + "default": "off" + }, + "aws_iam": { + "type": "object", + "properties": { + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-encrypted": true, + "x-referenceable": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_session_token": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true + }, + "bearer_token": { + "type": "string", + "description": "If the target AWS service supports Bearer token auth, you can set this token. This will disable request signing and also will override the AWS_BEARER_TOKEN_BEDROCK environment variable. It will also replace/ignore all settings pertaining to AWS IAM access keys and assumed-roles.", + "x-encrypted": true, + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." + }, + "assume_role_arn": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + }, + "role_session_name": { + "type": "string", + "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + }, + "sts_endpoint_url": { + "type": "string", + "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." + } + }, + "description": "Common AWS authentication options." + }, + "token_vault": { + "type": "object", + "properties": { + "storage": { + "type": "object", + "properties": { + "backend": { + "type": "string", + "enum": [ + "konnect" + ], + "description": "'konnect': the encrypted credential blob lives in Kong Identity, no gateway-side store.", + "default": "konnect" + }, + "current_version": { + "type": "string", + "description": "The version of the key in `keys` used to seal new credential envelopes. Rotation: add the new key under a new version, then point current_version at it -- older versions keep decrypting credentials sealed under them." + }, + "keys": { + "type": "array", + "items": { + "type": "object", + "properties": { + "version": { + "type": "string", + "description": "Unique identifier of this key version, referenced by current_version." + }, + "key": { + "type": "string", + "description": "PEM-encoded private key (EC or RSA) of this version of the gateway's credential key pair. Credentials are envelope-encrypted (per-credential DEK, A256GCM; the DEK is wrapped to the matching public key), so only this gateway can decrypt them.", + "x-referenceable": true, + "x-encrypted": true + } + }, + "required": [ + "key", + "version" + ] + }, + "description": "Versions of the gateway's credential key pair. Only the version named by current_version seals new envelopes; every version tried when decrypting." + } + }, + "required": [ + "current_version", + "keys" + ], + "description": "Credential storage strategy. 'konnect' (default) keeps the gateway-hosted credential as an encrypted blob registered with Kong Identity." + }, + "cache": { + "type": "object", + "properties": { + "redis": { "type": "object", "properties": { - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + }, + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false }, - "aws_assume_role_arn": { + "host": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-encrypted": true, + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", "x-referenceable": true }, - "gcp_service_account_json": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "sentinel_password": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", "x-referenceable": true, "x-encrypted": true }, - "aws_is_serverless": { + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "ssl": { "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", "default": true }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, - "aws_role_session_name": { + "username": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-encrypted": true, + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, - "azure_client_id": { + "cloud_authentication": { + "type": "object", + "properties": { + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "auth_provider": { + "type": "string", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + } + }, + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + }, + "sentinel_master": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "azure_client_secret": { + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "password": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", "x-referenceable": true, "x-encrypted": true }, - "azure_tenant_id": { + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "sentinel_role": { "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true } - }, - "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - } - } - }, - "managed": { - "type": "boolean", - "description": "If enabled, Kong will maintain managed sessions with the MCP server.", - "default": true - } - }, - "description": "Enable managed session when Kong responds as MCP server in listener or conversion-listener modes. This doesn't affect the passthrough-listener mode as the state in that mode is maintained by the upstream MCP servers." - }, - "cache": { - "type": "object", - "properties": { - "tools_list": { - "type": "object", - "properties": { - "cache_scope": { - "type": "string", - "enum": [ - "private", - "public" - ], - "description": "Whether a 'tools/list' result may be cached across authorization contexts.", - "default": "private" - }, - "ttl_ms": { - "type": "integer", - "description": "How long a client may treat a 'tools/list' result as fresh, in milliseconds." - } - } - }, - "discover": { - "type": "object", - "properties": { - "ttl_ms": { - "type": "integer", - "description": "How long a client may treat a 'server/discover' result as fresh, in milliseconds." - }, - "cache_scope": { - "type": "string", - "enum": [ - "private", - "public" - ], - "description": "Whether a 'server/discover' result may be cached across authorization contexts.", - "default": "private" + } } - } - } - }, - "description": "Cache hints Kong emits on the cacheable operations it serves. Only clients on a protocol revision that defines them receive them." - }, - "tools_list_auth": { - "type": "object", - "properties": { - "access_token_header": { - "type": "string", - "description": "Specify a header name used to send the fetched access token to the upstream MCP server. The value should include the header name and the token prefix if needed. Defaults to 'Authorization'." - }, - "id_token_header": { - "type": "string", - "description": "Specify a header name used to send the fetched ID token to the upstream MCP server. The value should include the header name and the token prefix if needed. Leave this empty to not send the ID token during tools list." - }, - "token_endpoint": { - "type": "string", - "description": "The token endpoint URL for fetching the OAuth 2.0 access token using client-credentials.", - "x-referenceable": true + }, + "description": "Optional best-effort L2 cache for exchanged credentials. Losing it only costs a re-exchange." }, - "client_id": { + "directory": { "type": "string", - "description": "The client ID for the OAuth 2.0 client-credentials.", - "x-referenceable": true, - "x-encrypted": true + "description": "Directory name segment of the vault token endpoint." }, - "client_secret": { + "provider": { "type": "string", - "description": "The client secret for the OAuth 2.0 client-credentials.", - "x-referenceable": true, - "x-encrypted": true + "description": "Name or UUID of the upstream credential provider registered in the Token Vault directory." }, - "scope": { + "subject_token_type": { "type": "string", - "description": "The scopes for the OAuth 2.0 client-credentials.", - "x-referenceable": true + "enum": [ + "access_token", + "api_key" + ], + "description": "Which kind of bearer token the caller presents, sent to the vault as the RFC 8693 subject_token_type. When unset, resolved from the request where provable; else inferred from the token's shape: a JWS is an access_token, anything else an api_key." } }, - "description": "Provide OAuth 2.0 client-credentials that can be used for fetching the tools list from an upstream MCP server. This is only applicable when mode is 'upstream-server'. The credentials will be stored in Kong and sent to the upstream MCP server when fetching the tools list." - }, - "forward_client_headers": { - "type": "boolean", - "description": "Whether to forward the client request headers to the upstream server when calling the tools.", - "default": true - }, - "allowed_versions": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "2025-03-26", - "2025-06-18", - "2025-11-25", - "2026-07-28" - ] - }, - "minLength": 1, - "description": "The MCP protocol revisions this server accepts. Leave unset to accept every revision Kong implements, which is the default. When set, `server/discover` advertises exactly this list and a request declaring anything else is rejected with `-32022`. Listing only per-request revisions refuses handshake clients." - }, - "preserve_upstream_tool_names": { - "type": "boolean", - "description": "If enabled, the original upstream tool names are preserved as-is when Kong acts as an MCP server. If disabled (false), the service name will be prepended to the MCP tool names to avoid name collisions when multiple services are used.", - "default": false - }, - "upstream_protocol_version": { - "type": "string", - "enum": [ - "2025-03-26", - "2025-06-18", - "2025-11-25", - "2026-07-28" - ], - "description": "The MCP protocol revision Kong speaks to the upstream MCP server. Leave unset to negotiate a handshake revision with an `initialize` exchange, which is the default. Set a per-request revision to reach an upstream that answers no handshake and mints no session." - }, - "tag": { - "type": "string", - "description": "The tag of the MCP server. This is used to filter the exported MCP tools. The field should contain exactly one tag. " - } - } - }, - "logging": { - "type": "object", - "properties": { - "log_statistics": { - "type": "boolean", - "description": "If enabled, will add mcp metrics into the Kong log policy(s) output.", - "default": false - }, - "log_payloads": { - "type": "boolean", - "description": "If enabled, will log the request and response body into the Kong log policy(s) output.", - "default": false - }, - "log_audits": { - "type": "boolean", - "description": "If true, emit audit logs for ACL evaluations.", - "default": false - } - } - }, - "proxy_config": { - "type": "object", - "properties": { - "proxy_scheme": { - "type": "string", - "enum": [ - "http" + "required": [ + "directory", + "provider", + "storage" ], - "description": "The proxy scheme to use when connecting. Only `http` is supported.", - "default": "http" - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." + "description": "Resolve an upstream credential per request via the Kong Token Vault." } - } - }, - "tools_cache_ttl_seconds": { - "type": "integer", - "description": "The time-to-live (TTL) for the upstream tools cache in seconds. Set to 0 to refresh on every client call." + }, + "description": "Set the provider and its options for authenticating requests before proxying." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiMcpSanitizer.json b/app/_schemas/ai-gateway/policies/AiMcpSanitizer.json new file mode 100644 index 00000000000..8f6ec7d0373 --- /dev/null +++ b/app/_schemas/ai-gateway/policies/AiMcpSanitizer.json @@ -0,0 +1,257 @@ +{ + "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "config": { + "type": "object", + "properties": { + "continue_on_detection": { + "type": "boolean", + "description": "If true, the guardrail will not block the request or response. Sanitization data and details will still be visible via kong logs.", + "default": false + }, + "host": { + "type": "string", + "description": "The host of the sanitizer", + "default": "localhost" + }, + "scheme": { + "type": "string", + "description": "The protocol can be http and https", + "default": "http" + }, + "anonymize": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "all", + "all_and_credentials", + "bank", + "credentials", + "creditcard", + "crypto", + "custom", + "date", + "domain", + "driverlicense", + "email", + "general", + "ip", + "medical", + "nationalid", + "nrp", + "passport", + "phone", + "ssn", + "url" + ] + }, + "description": "List of types to be anonymized", + "default": [ + "all_and_credentials" + ] + }, + "block_if_detected": { + "type": "boolean", + "description": "Whether to block requests containing PII data", + "default": false + }, + "skip_logging_sanitized_items": { + "type": "boolean", + "description": "Whether to log sanitized items in the Kong log policies. Turn it on if you want to hide sensitive data from logs.", + "default": false + }, + "keepalive_timeout": { + "type": "number", + "description": "The keepalive timeout for the established http connnection", + "default": 60000 + }, + "stop_on_error": { + "type": "boolean", + "description": "Stop processing if an error occurs.", + "default": true + }, + "recover_redacted": { + "type": "boolean", + "description": "Whether to recover redacted data. This doesn't apply to the redacted output.", + "default": true + }, + "custom_patterns": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "regex": { + "type": "string" + }, + "score": { + "type": "number", + "maximum": 1, + "minimum": 0, + "default": 0.5 + } + }, + "required": [ + "name", + "regex" + ] + }, + "minLength": 1, + "description": "List of custom patterns to be used for anonymization" + }, + "proxy_config": { + "type": "object", + "properties": { + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" + }, + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-encrypted": true, + "x-referenceable": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + } + } + }, + "port": { + "type": "number", + "description": "The port of the sanitizer", + "default": 8080 + }, + "timeout": { + "type": "number", + "description": "Connection timeout with the sanitizer service.", + "default": 10000 + }, + "redact_type": { + "type": "string", + "enum": [ + "placeholder", + "synthetic" + ], + "description": "What value to be used to redacted to", + "default": "placeholder" + }, + "rejection_mode": { + "type": "string", + "enum": [ + "none", + "stealth", + "verbose" + ], + "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", + "default": "none" + }, + "sanitize_targets": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "tool_arguments", + "tool_results" + ] + }, + "description": "Which parts of an MCP `tools/call` to sanitize: `tool_arguments` are the arguments on their way to the tool server, `tool_results` is the result on its way back to the calling agent.", + "default": [ + "tool_arguments" + ] + } + } + }, + "consumer": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "additionalProperties": false, + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + }, + "consumer_group": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "additionalProperties": false, + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + }, + "route": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "additionalProperties": false, + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + }, + "service": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "additionalProperties": false, + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + } + } +} \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/AiNvidiaNemoGuardrail.json b/app/_schemas/ai-gateway/policies/AiNvidiaNemoGuardrail.json index ef290bfbc70..050dad70412 100644 --- a/app/_schemas/ai-gateway/policies/AiNvidiaNemoGuardrail.json +++ b/app/_schemas/ai-gateway/policies/AiNvidiaNemoGuardrail.json @@ -25,12 +25,6 @@ "auth": { "type": "object", "properties": { - "api_key": { - "type": "string", - "description": "API key sent to NeMo for LLM authentication.", - "x-referenceable": true, - "x-encrypted": true - }, "header": { "type": "string", "description": "Header name used to forward the API key.", @@ -38,18 +32,24 @@ }, "prefix": { "type": "string", - "description": "Prefix prepended to auth.api_key when building the header value.", - "default": "Bearer " + "description": "Prefix prepended to auth.api_key when building the header value. NeMo consumes the default X-Model-Authorization header value verbatim, so no prefix is applied by default.", + "default": "" + }, + "api_key": { + "type": "string", + "description": "API key sent to NeMo for LLM authentication.", + "x-encrypted": true, + "x-referenceable": true } }, "required": [ "api_key" ] }, - "stop_on_error": { - "type": "boolean", - "description": "Stop processing if an error occurs.", - "default": true + "timeout": { + "type": "number", + "description": "Connection timeout with the guardrail service.", + "default": 10000 }, "guarding_mode": { "type": "string", @@ -61,6 +61,11 @@ "description": "The guardrail mode to use for the request.", "default": "INPUT" }, + "allow_masking": { + "type": "boolean", + "description": "Allow masking the request/response instead of blocking it. Streaming will be disabled if this is enabled.", + "default": false + }, "text_source": { "type": "string", "enum": [ @@ -70,29 +75,23 @@ "description": "Select where to pick the 'text' for the guardrail service request.", "default": "concatenate_all_content" }, - "ssl_verify": { + "response_buffer_size": { + "type": "number", + "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", + "default": 100 + }, + "stop_on_error": { "type": "boolean", - "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", + "description": "Stop processing if an error occurs.", "default": true }, - "nemo_endpoint": { - "type": "string", - "description": "Full URL of the NeMo Guardrails checks endpoint, e.g. http://nemo-guardrails:7331/v1/guardrail/checks." - }, - "request_failure_message": { + "response_failure_message": { "type": "string", - "description": "The message to return when a failure occurs on the request phase." + "description": "The message to return when a failure occurs on the response phase." }, "guardrails": { "type": "object", "properties": { - "config": { - "type": "object", - "additionalProperties": true, - "description": "Inline guardrail configuration, forwarded to NeMo as-is under guardrails.config (see https://docs.nvidia.com/nemo/guardrails/configure-guardrails/configuration-reference).", - "nullable": true, - "x-speakeasy-type-override": "any" - }, "config_id": { "type": "string", "description": "Name of a single stored guardrail configuration." @@ -103,40 +102,23 @@ "type": "string" }, "description": "Stored configurations to combine, in order." + }, + "config": { + "type": "object", + "additionalProperties": true, + "description": "Inline guardrail configuration, forwarded to NeMo as-is under guardrails.config (see https://docs.nvidia.com/nemo/guardrails/configure-guardrails/configuration-reference).", + "nullable": true, + "x-speakeasy-type-override": "any" } } }, - "timeout": { - "type": "number", - "description": "Connection timeout with the guardrail service.", - "default": 10000 - }, - "allow_masking": { - "type": "boolean", - "description": "Allow masking the request/response instead of blocking it. Streaming will be disabled if this is enabled.", - "default": false - }, - "response_failure_message": { + "model": { "type": "string", - "description": "The message to return when a failure occurs on the response phase." + "description": "Model name sent in the request body." }, "proxy_config": { "type": "object", "properties": { - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, "https_proxy_port": { "type": "integer", "maximum": 65535, @@ -165,22 +147,40 @@ "no_proxy": { "type": "string", "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." } } }, - "model": { - "type": "string", - "description": "Model name sent in the request body." - }, - "response_buffer_size": { - "type": "number", - "description": "The amount of bytes receiving from upstream to be buffered before sending to the guardrail service. This only applies to the response content guard.", - "default": 100 - }, "log_blocked_content": { "type": "boolean", "description": "Whether to log prompts and responses that are blocked by the guardrail.", "default": false + }, + "nemo_endpoint": { + "type": "string", + "description": "Full URL of the NeMo Guardrails checks endpoint, e.g. http://nemo-guardrails:7331/v1/guardrail/checks." + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the SSL certificate of the guardrail service endpoint.", + "default": true + }, + "request_failure_message": { + "type": "string", + "description": "The message to return when a failure occurs on the request phase." } }, "required": [ @@ -188,7 +188,7 @@ "nemo_endpoint" ] }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -196,9 +196,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -206,9 +206,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -216,9 +216,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -226,7 +226,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiPromptCompressor.json b/app/_schemas/ai-gateway/policies/AiPromptCompressor.json index 3566d8b8a76..f033a7a16c5 100644 --- a/app/_schemas/ai-gateway/policies/AiPromptCompressor.json +++ b/app/_schemas/ai-gateway/policies/AiPromptCompressor.json @@ -22,83 +22,45 @@ "config": { "type": "object", "properties": { - "provider": { + "compressor_url": { "type": "string", - "enum": [ - "headroom", - "kong" - ], - "description": "Which compression backend the policy talks to. 'kong' (default) is the Kong compressor service driven by 'compressor_type' and 'compression_ranges'; 'headroom' is a Headroom instance that decides the compression itself. Connection settings ('compressor_url', 'timeout', 'keepalive_timeout', 'stop_on_error', 'log_text_data', 'proxy_config') are shared by both. A field that does not apply to the selected provider is ignored, with a warning in the error log.", - "default": "kong" - }, - "headroom": { - "type": "object", - "properties": { - "proxy_token": { - "type": "string", - "description": "HEADROOM_PROXY_TOKEN, sent both as `X-Headroom-Proxy-Token` and as `Authorization: Bearer`. Required unless `compressor_url` is a loopback address (localhost, 127.0.0.0/8, ::1). A wrong token surfaces as 401.", - "x-encrypted": true, - "x-referenceable": true - }, - "ssl_verify": { - "type": "boolean", - "description": "Verify TLS certificate of the Headroom endpoint (for https endpoints).", - "default": true - }, - "session_id_headers": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Names of request headers that identify the conversation. Every configured header present on the request goes into the session id, concatenated in order, so several ids narrow the session instead of replacing it. Use headers that stay stable across turns: one that rotates per request stops the cache from hitting, and a caller id (installation, machine) collapses that caller's conversations onto one session. An empty array derives the id from the content.", - "default": [ - "session-id", - "thread-id", - "x-claude-code-agent-id", - "x-claude-code-session-id", - "x-session-id" - ] - } - }, - "description": "Headroom-specific settings, read only when `provider` is `headroom`. Point the policy-wide `compressor_url` at the Headroom `/v1/compress` endpoint, and keep the policy-wide `timeout` above the Headroom-side turn lock plus compression timeout. Headroom keeps its sessions in memory on one process, so point Kong at a single instance and not at a load-balanced set.", - "default": {} + "description": "The url of the compressor", + "default": "http://localhost:8080" }, - "timeout": { + "keepalive_timeout": { "type": "number", - "description": "Connection timeout with the compressor", - "default": 10000 + "description": "The keepalive timeout for the established http connnection", + "default": 60000 }, "stop_on_error": { "type": "boolean", "description": "Stop processing if an error occurs", "default": true }, - "message_type": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "assistant", - "system", - "user" - ] - }, - "default": [ - "user" - ] - }, - "compressor_type": { - "type": "string", - "enum": [ - "rate", - "target_token" - ], - "description": "What compression type to use to compress with", - "default": "rate" + "log_text_data": { + "type": "boolean", + "description": "Log the text data", + "default": false }, "proxy_config": { "type": "object", "properties": { + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, "proxy_scheme": { "type": "string", "enum": [ @@ -125,25 +87,37 @@ "http_proxy_host": { "type": "string", "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." } } }, + "timeout": { + "type": "number", + "description": "Connection timeout with the compressor", + "default": 10000 + }, + "message_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "assistant", + "system", + "user" + ] + }, + "default": [ + "user" + ] + }, + "compressor_type": { + "type": "string", + "enum": [ + "rate", + "target_token" + ], + "description": "What compression type to use to compress with", + "default": "rate" + }, "compression_ranges": { "type": "array", "items": { @@ -167,20 +141,46 @@ }, "description": "What value to be used to compress with. The 'value' is interpreted as rate or target_token depending on compressor_type. Required when 'provider' is 'kong', ignored otherwise." }, - "compressor_url": { + "provider": { "type": "string", - "description": "The url of the compressor", - "default": "http://localhost:8080" - }, - "keepalive_timeout": { - "type": "number", - "description": "The keepalive timeout for the established http connnection", - "default": 60000 + "enum": [ + "headroom", + "kong" + ], + "description": "Which compression backend the policy talks to. 'kong' (default) is the Kong compressor service driven by 'compressor_type' and 'compression_ranges'; 'headroom' is a Headroom instance that decides the compression itself. Connection settings ('compressor_url', 'timeout', 'keepalive_timeout', 'stop_on_error', 'log_text_data', 'proxy_config') are shared by both. A field that does not apply to the selected provider is ignored, with a warning in the error log.", + "default": "kong" }, - "log_text_data": { - "type": "boolean", - "description": "Log the text data", - "default": false + "headroom": { + "type": "object", + "properties": { + "proxy_token": { + "type": "string", + "description": "HEADROOM_PROXY_TOKEN, sent both as `X-Headroom-Proxy-Token` and as `Authorization: Bearer`. Required unless `compressor_url` is a loopback address (localhost, 127.0.0.0/8, ::1). A wrong token surfaces as 401.", + "x-referenceable": true, + "x-encrypted": true + }, + "ssl_verify": { + "type": "boolean", + "description": "Verify TLS certificate of the Headroom endpoint (for https endpoints).", + "default": true + }, + "session_id_headers": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Names of request headers that identify the conversation. Every configured header present on the request goes into the session id, concatenated in order, so several ids narrow the session instead of replacing it. Use headers that stay stable across turns: one that rotates per request stops the cache from hitting, and a caller id (installation, machine) collapses that caller's conversations onto one session. An empty array derives the id from the content.", + "default": [ + "session-id", + "thread-id", + "x-claude-code-agent-id", + "x-claude-code-session-id", + "x-session-id" + ] + } + }, + "description": "Headroom-specific settings, read only when `provider` is `headroom`. Point the policy-wide `compressor_url` at the Headroom `/v1/compress` endpoint, and keep the policy-wide `timeout` above the Headroom-side turn lock plus compression timeout. Headroom keeps its sessions in memory on one process, so point Kong at a single instance and not at a load-balanced set.", + "default": {} } } }, diff --git a/app/_schemas/ai-gateway/policies/AiPromptDecorator.json b/app/_schemas/ai-gateway/policies/AiPromptDecorator.json index a9219862cf9..5bfde78018a 100644 --- a/app/_schemas/ai-gateway/policies/AiPromptDecorator.json +++ b/app/_schemas/ai-gateway/policies/AiPromptDecorator.json @@ -102,7 +102,7 @@ } } }, - "consumer": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -110,9 +110,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "consumer_group": { + "route": { "type": "object", "properties": { "id": { @@ -120,9 +120,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -130,9 +130,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -140,7 +140,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/AiPromptGuard.json b/app/_schemas/ai-gateway/policies/AiPromptGuard.json index 9f92ea16e5e..718bea026cb 100644 --- a/app/_schemas/ai-gateway/policies/AiPromptGuard.json +++ b/app/_schemas/ai-gateway/policies/AiPromptGuard.json @@ -1,8 +1,37 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "rejection_mode": { + "type": "string", + "enum": [ + "none", + "stealth", + "verbose" + ], + "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", + "default": "none" + }, "allow_patterns": { "type": "array", "items": { @@ -13,21 +42,6 @@ "maxLength": 10, "description": "Array of valid regex patterns, or valid questions from the 'user' role in chat." }, - "allow_all_conversation_history": { - "type": "boolean", - "description": "If true, will ignore all previous chat prompts from the conversation history.", - "default": false - }, - "match_all_roles": { - "type": "boolean", - "description": "If true, will match all roles in addition to 'user' role in conversation history.", - "default": false - }, - "continue_on_detection": { - "type": "boolean", - "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", - "default": false - }, "deny_patterns": { "type": "array", "items": { @@ -43,20 +57,6 @@ "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", "default": 8388608 }, - "llm_format": { - "type": "string", - "enum": [ - "anthropic", - "bedrock", - "cohere", - "gemini", - "huggingface", - "openai", - "typesafe" - ], - "description": "LLM input and output format and schema to use", - "default": "openai" - }, "genai_category": { "type": "string", "enum": [ @@ -70,38 +70,38 @@ "description": "Generative AI category of the request", "default": "text/generation" }, - "rejection_mode": { + "allow_all_conversation_history": { + "type": "boolean", + "description": "If true, will ignore all previous chat prompts from the conversation history.", + "default": false + }, + "match_all_roles": { + "type": "boolean", + "description": "If true, will match all roles in addition to 'user' role in conversation history.", + "default": false + }, + "llm_format": { "type": "string", "enum": [ - "none", - "stealth", - "verbose" + "anthropic", + "bedrock", + "cohere", + "gemini", + "huggingface", + "openai", + "typesafe" ], - "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", - "default": "none" + "description": "LLM input and output format and schema to use", + "default": "openai" + }, + "continue_on_detection": { + "type": "boolean", + "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", + "default": false } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -109,9 +109,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer_group": { + "service": { "type": "object", "properties": { "id": { @@ -119,9 +119,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -129,9 +129,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -139,7 +139,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/AiPromptTemplate.json b/app/_schemas/ai-gateway/policies/AiPromptTemplate.json index 358fd0a7c97..d42fb2225d5 100644 --- a/app/_schemas/ai-gateway/policies/AiPromptTemplate.json +++ b/app/_schemas/ai-gateway/policies/AiPromptTemplate.json @@ -1,5 +1,24 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { @@ -8,13 +27,13 @@ "items": { "type": "object", "properties": { - "name": { - "type": "string", - "description": "Unique name for the template, can be called with `{template://NAME}`" - }, "template": { "type": "string", "description": "Template string for this request, supports mustache-style `{{placeholders}}`" + }, + "name": { + "type": "string", + "description": "Unique name for the template, can be called with `{template://NAME}`" } }, "required": [ @@ -44,26 +63,7 @@ "templates" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "consumer": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -71,9 +71,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "consumer_group": { + "route": { "type": "object", "properties": { "id": { @@ -81,9 +81,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -91,9 +91,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -101,7 +101,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiProxyAdvanced.json b/app/_schemas/ai-gateway/policies/AiProxyAdvanced.json index ce5f94a53b9..e8a019b486e 100644 --- a/app/_schemas/ai-gateway/policies/AiProxyAdvanced.json +++ b/app/_schemas/ai-gateway/policies/AiProxyAdvanced.json @@ -107,18 +107,6 @@ "items": { "type": "object", "properties": { - "key": { - "type": "string", - "description": "Helper key used by some types: consumer (id|username), consumer_group (id|name), header (header name)." - }, - "values": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "Allowed values for the selected type." - }, "type": { "type": "string", "enum": [ @@ -132,6 +120,18 @@ "provider" ], "description": "The attribute to match against." + }, + "key": { + "type": "string", + "description": "Helper key used by some types: consumer (id|username), consumer_group (id|name), header (header name)." + }, + "values": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "Allowed values for the selected type." } }, "required": [ @@ -158,7 +158,23 @@ "balancer": { "type": "object", "properties": { - "read_timeout": { + "latency_strategy": { + "type": "string", + "enum": [ + "e2e", + "tpot" + ], + "description": "What metrics to use for latency. Available values are: `tpot` (time-per-output-token) and `e2e`.", + "default": "tpot" + }, + "retries": { + "type": "integer", + "maximum": 32767, + "minimum": 0, + "description": "The number of retries to execute upon failure to proxy.", + "default": 5 + }, + "connect_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 1, @@ -170,44 +186,42 @@ "type": "string", "enum": [ "error", + "http_400", + "http_401", + "http_402", "http_403", "http_404", + "http_405", + "http_408", + "http_409", + "http_413", + "http_415", + "http_422", "http_429", "http_500", "http_502", "http_503", "http_504", + "http_522", + "http_529", + "http_5xx", "invalid_header", "non_idempotent", "timeout" ] }, - "description": "Specifies in which cases an upstream response should be failover to the next target. Each option in the array is equivalent to the function of http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream", + "description": "Conditions that trigger failover to the next target. Accepts `error`, `timeout`, `invalid_header`, `non_idempotent`, and the listed `http_` options, including `http_522` and `http_529`. `http_5xx` matches any 5xx status, including statuses nginx does not natively retry such as 501 or 522.", "default": [ "error", "timeout" ] }, - "max_fails": { + "fail_timeout": { "type": "integer", - "maximum": 32767, - "minimum": 0, - "description": "Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. Note the cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful attempts, while the cases of `http_403` and `http_404` are never considered unsuccessful attempts.", - "default": 0 - }, - "algorithm": { - "type": "string", - "enum": [ - "consistent-hashing", - "least-connections", - "lowest-latency", - "lowest-usage", - "priority", - "round-robin", - "semantic" - ], - "description": "Which load balancing algorithm to use.", - "default": "round-robin" + "maximum": 2147483646, + "minimum": 1, + "description": "The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`.", + "default": 10000 }, "tokens_count_strategy": { "type": "string", @@ -221,14 +235,10 @@ "description": "What tokens to use for usage calculation. Available values are: `total_tokens` `prompt_tokens`, `completion_tokens` and `cost`.", "default": "total-tokens" }, - "latency_strategy": { + "hash_on_header": { "type": "string", - "enum": [ - "e2e", - "tpot" - ], - "description": "What metrics to use for latency. Available values are: `tpot` (time-per-output-token) and `e2e`.", - "default": "tpot" + "description": "The header to use for consistent-hashing.", + "default": "X-Kong-LLM-Request-ID" }, "slots": { "type": "integer", @@ -243,337 +253,445 @@ "minimum": 1, "default": 60000 }, - "fail_timeout": { + "read_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 1, - "description": "The period of time (in milliseconds) the target will be considered unavailable after the number of unsuccessful attempts reaches `max_fails`.", - "default": 10000 - }, - "hash_on_header": { - "type": "string", - "description": "The header to use for consistent-hashing.", - "default": "X-Kong-LLM-Request-ID" + "default": 60000 }, - "retries": { + "max_fails": { "type": "integer", "maximum": 32767, "minimum": 0, - "description": "The number of retries to execute upon failure to proxy.", - "default": 5 + "description": "Number of unsuccessful attempts to communicate with a target that should occur in the duration defined by `fail_timeout` before the target is considered unavailable. The zero value disables the circuit breaker. What is considered an unsuccessful attempt is defined by `failover_criteria`. The cases of `error`, `timeout` and `invalid_header` are always considered unsuccessful. Configured HTTP 429 and 5xx responses count as failures; other 4xx responses do not.", + "default": 0 }, - "connect_timeout": { + "algorithm": { + "type": "string", + "enum": [ + "consistent-hashing", + "least-connections", + "lowest-latency", + "lowest-usage", + "priority", + "round-robin", + "semantic" + ], + "description": "Which load balancing algorithm to use.", + "default": "round-robin" + } + } + }, + "proxy_config": { + "type": "object", + "properties": { + "http_proxy_port": { "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "default": 60000 + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" + }, + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." } } }, - "embeddings": { + "vectordb": { "type": "object", "properties": { - "auth": { + "dimensions": { + "type": "integer", + "description": "the desired dimensionality for the vectors" + }, + "threshold": { + "type": "number", + "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." + }, + "distance_metric": { + "type": "string", + "enum": [ + "cosine", + "euclidean" + ], + "description": "the distance metric to use for vector searches" + }, + "redis": { "type": "object", "properties": { - "aws_access_key_id": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, - "azure_client_id": { + "sentinel_username": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "azure_client_secret": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_session_token": { + "sentinel_password": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", "x-referenceable": true, "x-encrypted": true }, - "param_value": { - "type": "string", - "description": "Specify the full parameter value for 'param_name'.", - "x-referenceable": true, - "x-encrypted": true + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." }, - "azure_tenant_id": { + "sentinel_master": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", - "x-referenceable": true + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "gcp_workload_identity_federation_source": { + "sentinel_role": { "type": "string", "enum": [ - "aws_iam", - "off" + "any", + "master", + "slave" ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." - }, - "header_name": { - "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", - "x-referenceable": true - }, - "header_value": { - "type": "string", - "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_use_managed_identity": { - "type": "boolean", - "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", - "default": false - }, - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, - "gcp_metadata_url": { - "type": "string", - "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, "x-referenceable": true }, - "param_name": { + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "host": { "type": "string", - "description": "If AI model requires authentication via query parameter, specify its name here.", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", "x-referenceable": true }, - "param_location": { + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { "type": "string", - "enum": [ - "body", - "query" - ], - "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true }, - "gcp_oauth_token_url": { + "password": { "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-encrypted": true, "x-referenceable": true }, - "allow_override": { - "type": "boolean", - "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", - "default": false + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 }, - "gcp_workload_identity_federation_auth_json": { - "type": "string", - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", - "x-referenceable": true, - "x-encrypted": true - } - } - }, - "model": { - "type": "object", - "properties": { - "options": { + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "cloud_authentication": { "type": "object", "properties": { - "databricks": { - "type": "object", - "properties": { - "workspace_instance_id": { - "type": "string", - "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." - } - } + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true }, - "upstream_url": { + "azure_client_secret": { "type": "string", - "description": "upstream url for the embeddings" + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true }, - "azure": { - "type": "object", - "properties": { - "instance": { - "type": "string", - "description": "Instance name for Azure OpenAI hosted models." - }, - "api_version": { - "type": "string", - "description": "'api-version' for Azure OpenAI instances.", - "default": "2023-05-15" - }, - "deployment_id": { - "type": "string", - "description": "Deployment ID for Azure OpenAI instances." - } - } + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true }, - "bedrock": { - "type": "object", - "properties": { - "aws_sts_endpoint_url": { - "type": "string", - "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." - }, - "embeddings_normalize": { - "type": "boolean", - "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", - "default": false - }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." - }, - "batch_bucket_prefix": { - "type": "string", - "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." - }, - "batch_role_arn": { - "type": "string", - "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." - }, - "aws_region": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." - }, - "aws_assume_role_arn": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." - }, - "aws_role_session_name": { - "type": "string", - "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." - }, - "video_output_s3_uri": { - "type": "string", - "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." - } - } + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true }, - "gemini": { - "type": "object", - "properties": { - "api_endpoint": { - "type": "string", - "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." - }, - "project_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the project ID." - }, - "location_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the location ID." - } - } + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true }, - "huggingface": { - "type": "object", - "properties": { - "use_cache": { - "type": "boolean", - "description": "Use the cache layer on the inference API" - }, - "wait_for_model": { - "type": "boolean", - "description": "Wait for the model if it is not ready" - } - } - } - }, - "description": "Key/value settings for the model" - }, - "provider": { - "type": "string", - "enum": [ - "azure", - "bedrock", - "databricks", - "gemini", - "huggingface", - "mistral", - "ollama", - "openai", - "vercel" - ], - "description": "AI provider format to use for embeddings API" - }, - "name": { - "type": "string", - "description": "Model name to execute." - } - }, - "required": [ - "name", - "provider" - ] - } - }, - "required": [ - "model" - ] - }, - "proxy_config": { - "type": "object", - "properties": { - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-encrypted": true, - "x-referenceable": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "auth_provider": { + "type": "string", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true + }, + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + } + }, + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + }, + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + } + } }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." + "pgvector": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "the host of the pgvector database", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "description": "the port of the pgvector database", + "default": 5432 + }, + "user": { + "type": "string", + "description": "the user of the pgvector database", + "default": "postgres", + "x-referenceable": true + }, + "database": { + "type": "string", + "description": "the database of the pgvector database", + "default": "kong-pgvector" + }, + "ssl": { + "type": "boolean", + "description": "whether to use ssl for the pgvector database", + "default": false + }, + "ssl_required": { + "type": "boolean", + "description": "whether ssl is required for the pgvector database", + "default": false + }, + "ssl_verify": { + "type": "boolean", + "description": "whether to verify ssl for the pgvector database", + "default": true + }, + "ssl_cert": { + "type": "string", + "description": "the path of ssl cert to use for the pgvector database" + }, + "password": { + "type": "string", + "description": "the password of the pgvector database", + "x-referenceable": true, + "x-encrypted": true + }, + "timeout": { + "type": "number", + "description": "the timeout of the pgvector database", + "default": 5000 + }, + "ssl_version": { + "type": "string", + "enum": [ + "any", + "tlsv1_2", + "tlsv1_3" + ], + "description": "the ssl version to use for the pgvector database", + "default": "tlsv1_2" + }, + "ssl_cert_key": { + "type": "string", + "description": "the path of ssl cert key to use for the pgvector database" + } + } }, - "proxy_scheme": { + "strategy": { "type": "string", "enum": [ - "http" + "pgvector", + "redis" ], - "description": "The proxy scheme to use when connecting. Only `http` is supported.", - "default": "http" + "description": "which vector database driver to use" + } + }, + "required": [ + "dimensions", + "distance_metric", + "strategy" + ] + }, + "dynamic_pricing": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "When true, the resolver reads prices from the catalog polled from 'uri' and ignores the pricing partial's 'models' array and every per-target model.options price on the request path; the catalog is the sole source of pricing. A model the catalog does not price bills 0 with a rate-limited warn.", + "default": false }, - "auth_username": { + "uri": { "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true + "description": "URI of the pricing catalog to poll periodically. Either an HTTP(S) URL or a file:// path; both are re-read on the same interval, so a local catalog behaves like a remote one. The default serves self-managed deployments (the public baseline catalog, no authentication); Konnect-managed gateways receive their per-gateway URL from the control plane. Air-gapped deployments should set a file:// URI explicitly.", + "default": "https://us.cp0.konghq.tech/v0/llmpricing/gateway-catalog" + }, + "fetch_interval_seconds": { + "type": "integer", + "description": "How often, in seconds, the data plane re-reads the catalog from 'uri'.", + "default": 3600 } } }, @@ -592,11 +710,6 @@ "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", "default": 8388608 }, - "model_name_header": { - "type": "boolean", - "description": "Display the model name selected in the X-Kong-LLM-Model response header", - "default": true - }, "llm_format": { "type": "string", "enum": [ @@ -611,349 +724,263 @@ "description": "LLM input and output format and schema to use", "default": "openai" }, - "vectordb": { + "embeddings": { "type": "object", "properties": { - "strategy": { - "type": "string", - "enum": [ - "pgvector", - "redis" - ], - "description": "which vector database driver to use" - }, - "dimensions": { - "type": "integer", - "description": "the desired dimensionality for the vectors" - }, - "threshold": { - "type": "number", - "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." - }, - "distance_metric": { - "type": "string", - "enum": [ - "cosine", - "euclidean" - ], - "description": "the distance metric to use for vector searches" - }, - "redis": { + "model": { "type": "object", "properties": { - "username": { + "provider": { "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true + "enum": [ + "azure", + "bedrock", + "databricks", + "gemini", + "huggingface", + "mistral", + "ollama", + "openai", + "vercel" + ], + "description": "AI provider format to use for embeddings API" }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "password": { + "name": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-encrypted": true, - "x-referenceable": true + "description": "Model name to execute." }, - "cloud_authentication": { + "options": { "type": "object", "properties": { - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_role_session_name": { - "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-referenceable": true, - "x-encrypted": true + "azure": { + "type": "object", + "properties": { + "instance": { + "type": "string", + "description": "Instance name for Azure OpenAI hosted models." + }, + "api_version": { + "type": "string", + "description": "'api-version' for Azure OpenAI instances.", + "default": "2023-05-15" + }, + "deployment_id": { + "type": "string", + "description": "Deployment ID for Azure OpenAI instances." + } + } }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true + "bedrock": { + "type": "object", + "properties": { + "aws_assume_role_arn": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + }, + "aws_role_session_name": { + "type": "string", + "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + }, + "embeddings_normalize": { + "type": "boolean", + "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", + "default": false + }, + "video_output_s3_uri": { + "type": "string", + "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." + }, + "batch_bucket_prefix": { + "type": "string", + "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." + }, + "aws_sts_endpoint_url": { + "type": "string", + "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." + }, + "performance_config_latency": { + "type": "string", + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." + }, + "batch_role_arn": { + "type": "string", + "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." + }, + "aws_region": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." + } + } }, - "aws_assume_role_arn": { - "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true + "gemini": { + "type": "object", + "properties": { + "project_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the project ID." + }, + "location_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the location ID." + }, + "api_endpoint": { + "type": "string", + "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." + } + } }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true + "huggingface": { + "type": "object", + "properties": { + "use_cache": { + "type": "boolean", + "description": "Use the cache layer on the inference API" + }, + "wait_for_model": { + "type": "boolean", + "description": "Wait for the model if it is not ready" + } + } }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "databricks": { + "type": "object", + "properties": { + "workspace_instance_id": { + "type": "string", + "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." + } + } }, - "azure_client_secret": { + "upstream_url": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "description": "upstream url for the embeddings" } }, - "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "sentinel_master": { + "description": "Key/value settings for the model" + } + }, + "required": [ + "name", + "provider" + ] + }, + "auth": { + "type": "object", + "properties": { + "azure_client_id": { "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", + "x-referenceable": true }, - "sentinel_role": { + "header_name": { "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", + "x-referenceable": true }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + "param_name": { + "type": "string", + "description": "If AI model requires authentication via query parameter, specify its name here.", + "x-referenceable": true }, - "ssl": { + "param_location": { + "type": "string", + "enum": [ + "body", + "query" + ], + "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." + }, + "azure_use_managed_identity": { "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", + "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", "default": false }, - "host": { + "gcp_metadata_url": { "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", + "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", "x-referenceable": true }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true + "allow_override": { + "type": "boolean", + "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "default": false }, - "sentinel_password": { + "param_value": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "description": "Specify the full parameter value for 'param_name'.", "x-referenceable": true, "x-encrypted": true }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - } - } - }, - "pgvector": { - "type": "object", - "properties": { - "host": { + "azure_tenant_id": { "type": "string", - "description": "the host of the pgvector database", - "default": "127.0.0.1" + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "x-referenceable": true }, - "password": { + "gcp_use_service_account": { + "type": "boolean", + "description": "Use service account auth for GCP-based providers and models.", + "default": false + }, + "gcp_service_account_json": { "type": "string", - "description": "the password of the pgvector database", + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", "x-referenceable": true, "x-encrypted": true }, - "database": { + "gcp_oauth_token_url": { "type": "string", - "description": "the database of the pgvector database", - "default": "kong-pgvector" - }, - "timeout": { - "type": "number", - "description": "the timeout of the pgvector database", - "default": 5000 + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true }, - "ssl_required": { - "type": "boolean", - "description": "whether ssl is required for the pgvector database", - "default": false + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true }, - "ssl_version": { + "gcp_workload_identity_federation_source": { "type": "string", "enum": [ - "any", - "tlsv1_2", - "tlsv1_3" + "aws_iam", + "off" ], - "description": "the ssl version to use for the pgvector database", - "default": "tlsv1_2" + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." }, - "ssl_cert_key": { + "header_value": { "type": "string", - "description": "the path of ssl cert key to use for the pgvector database" - }, - "port": { - "type": "integer", - "description": "the port of the pgvector database", - "default": 5432 + "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", + "x-referenceable": true, + "x-encrypted": true }, - "user": { + "azure_client_secret": { "type": "string", - "description": "the user of the pgvector database", - "default": "postgres", - "x-referenceable": true + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", + "x-referenceable": true, + "x-encrypted": true }, - "ssl": { - "type": "boolean", - "description": "whether to use ssl for the pgvector database", - "default": false + "aws_secret_access_key": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true }, - "ssl_verify": { - "type": "boolean", - "description": "whether to verify ssl for the pgvector database", - "default": true + "aws_session_token": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "x-referenceable": true, + "x-encrypted": true }, - "ssl_cert": { + "gcp_workload_identity_federation_auth_json": { "type": "string", - "description": "the path of ssl cert to use for the pgvector database" + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", + "x-referenceable": true, + "x-encrypted": true } } } }, "required": [ - "dimensions", - "distance_metric", - "strategy" + "model" ] }, "pricing": { @@ -989,11 +1016,40 @@ } } }, + "model_name_header": { + "type": "boolean", + "description": "Display the model name selected in the X-Kong-LLM-Model response header", + "default": true + }, "targets": { "type": "array", "items": { "type": "object", "properties": { + "logging": { + "type": "object", + "properties": { + "log_statistics": { + "type": "boolean", + "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log policy(s) output.", + "default": false + }, + "log_payloads": { + "type": "boolean", + "description": "If enabled, will log the request and response body into the Kong log policy(s) output.Furthermore if Opentelemetry instrumentation is enabled the traces will contain this data as well.", + "default": false + }, + "opentelemetry_attribute_keys_format": { + "type": "string", + "enum": [ + "openinference", + "openllmetry" + ], + "description": "Sets the keys standard to be used for OpenTelemetry trace attributes and metrics.", + "default": "openllmetry" + } + } + }, "weight": { "type": "integer", "maximum": 65535, @@ -1037,32 +1093,21 @@ "auth": { "type": "object", "properties": { - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false - }, - "gcp_oauth_token_url": { - "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", - "x-referenceable": true - }, "gcp_metadata_url": { "type": "string", "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", "x-referenceable": true }, - "aws_access_key_id": { + "param_value": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "description": "Specify the full parameter value for 'param_name'.", "x-referenceable": true, "x-encrypted": true }, - "aws_secret_access_key": { + "gcp_oauth_token_url": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true }, "aws_session_token": { "type": "string", @@ -1070,28 +1115,11 @@ "x-referenceable": true, "x-encrypted": true }, - "header_name": { - "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", - "x-referenceable": true - }, - "header_value": { - "type": "string", - "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", - "x-encrypted": true, - "x-referenceable": true - }, "param_name": { "type": "string", "description": "If AI model requires authentication via query parameter, specify its name here.", "x-referenceable": true }, - "gcp_workload_identity_federation_auth_json": { - "type": "string", - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", - "x-referenceable": true, - "x-encrypted": true - }, "param_location": { "type": "string", "enum": [ @@ -1105,6 +1133,40 @@ "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", "default": false }, + "gcp_service_account_json": { + "type": "string", + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_workload_identity_federation_auth_json": { + "type": "string", + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true + }, + "header_name": { + "type": "string", + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", + "x-referenceable": true + }, + "header_value": { + "type": "string", + "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", + "x-referenceable": true + }, "azure_client_secret": { "type": "string", "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", @@ -1116,17 +1178,22 @@ "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", "x-referenceable": true }, - "gcp_service_account_json": { - "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", - "x-referenceable": true, - "x-encrypted": true + "gcp_use_service_account": { + "type": "boolean", + "description": "Use service account auth for GCP-based providers and models.", + "default": false }, "allow_override": { "type": "boolean", "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", "default": false }, + "aws_secret_access_key": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true + }, "gcp_workload_identity_federation_source": { "type": "string", "enum": [ @@ -1134,66 +1201,60 @@ "off" ], "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." - }, - "param_value": { - "type": "string", - "description": "Specify the full parameter value for 'param_name'.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", - "x-referenceable": true } } }, "model": { "type": "object", "properties": { + "model_alias": { + "type": "string", + "description": "The model name parameter from the request that this model should map to." + }, "options": { "type": "object", "properties": { - "huggingface": { - "type": "object", - "properties": { - "use_cache": { - "type": "boolean", - "description": "Use the cache layer on the inference API" - }, - "wait_for_model": { - "type": "boolean", - "description": "Wait for the model if it is not ready" - } - } - }, - "databricks": { - "type": "object", - "properties": { - "workspace_instance_id": { - "type": "string", - "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." - } - } - }, "cache_read_cost": { "type": "number", "description": "Defines the cost per 1M cache-read (cached) prompt tokens." }, - "temperature": { - "type": "number", - "maximum": 5, - "minimum": 0, - "description": "Defines the matching temperature, if using chat or completion models." + "output_cost_list": { + "type": "array", + "items": { + "type": "object", + "properties": { + "modal": { + "type": "string", + "enum": [ + "audio", + "image", + "text", + "video" + ] + }, + "cost": { + "type": "number" + } + }, + "required": [ + "cost", + "modal" + ] + }, + "description": "Per-modality override of `output_cost`, in cost per 1M output tokens. Set it for models that price each modality separately." }, - "azure_service": { + "llama2_format": { "type": "string", "enum": [ - "azure-foundry", - "azure-openai" + "ollama", + "openai", + "raw" ], - "description": "Service type for Azure provider models.", - "default": "azure-openai" + "description": "If using llama2 provider, select the upstream message format." + }, + "upstream_url": { + "type": "string", + "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." }, "embeddings_dimensions": { "type": "integer", @@ -1202,6 +1263,10 @@ "gemini": { "type": "object", "properties": { + "endpoint_id": { + "type": "string", + "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." + }, "api_endpoint": { "type": "string", "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." @@ -1213,47 +1278,59 @@ "location_id": { "type": "string", "description": "If running Gemini on Vertex, specify the location ID." - }, - "endpoint_id": { + } + } + }, + "databricks": { + "type": "object", + "properties": { + "workspace_instance_id": { "type": "string", - "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." + "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." } } }, - "cache_write_cost": { + "output_cost": { "type": "number", - "description": "Defines the cost per 1M cache-write prompt tokens." + "description": "Defines the cost per 1M tokens in the output of the AI." }, - "azure_foundry_resource": { + "azure_api_version": { "type": "string", - "description": "Resource name for Azure Foundry hosted models." + "description": "'api-version' for Azure OpenAI instances.", + "default": "2023-05-15" }, - "max_tokens": { - "type": "integer", - "description": "Defines the max_tokens, if using chat or completion models." + "azure_foundry_domain": { + "type": "string", + "description": "Domain for Azure Foundry hosted models.", + "default": "services.ai.azure.com" }, - "context_window_factor": { + "azure_foundry_path_prefix": { + "type": "string", + "enum": [ + "/anthropic/v1", + "/openai/v1" + ], + "description": "Path prefix for Azure Foundry hosted models.", + "default": "/openai/v1" + }, + "cache_write_cost_list": { "type": "array", "items": { "type": "object", "properties": { - "above": { + "ttl": { "type": "string" }, - "input_factor": { - "type": "number" - }, - "output_factor": { + "cost": { "type": "number" } }, "required": [ - "above", - "input_factor", - "output_factor" + "cost", + "ttl" ] }, - "description": "Above an input-token threshold, scale input/output pricing with the corresponding factor." + "description": "Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this if the upstream provider charges differently for different cache TTLs, as Anthropic does for 5m and 1h TTLs." }, "top_p": { "type": "number", @@ -1261,34 +1338,13 @@ "minimum": 0, "description": "Defines the top-p probability mass, if supported." }, - "azure_deployment_id": { - "type": "string", - "description": "Deployment ID for Azure OpenAI instances." - }, - "llama2_format": { - "type": "string", - "enum": [ - "ollama", - "openai", - "raw" - ], - "description": "If using llama2 provider, select the upstream message format." - }, - "upstream_url": { + "azure_instance": { "type": "string", - "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." + "description": "Instance name for Azure OpenAI hosted models." }, "sagemaker": { "type": "object", "properties": { - "aws_region": { - "type": "string", - "description": "Override the `AWS_REGION` environment variable for SageMaker requests." - }, - "aws_assume_role_arn": { - "type": "string", - "description": "Assume a different IAM role after authentication." - }, "aws_role_session_name": { "type": "string", "description": "Identifier for the assumed role session." @@ -1308,35 +1364,40 @@ "target_container_hostname": { "type": "string", "description": "Sets the X-Amzn-SageMaker-Target-Container-Hostname header for multi-container endpoints." + }, + "aws_region": { + "type": "string", + "description": "Override the `AWS_REGION` environment variable for SageMaker requests." + }, + "aws_assume_role_arn": { + "type": "string", + "description": "Assume a different IAM role after authentication." } } }, - "input_cost_list": { - "type": "array", - "items": { - "type": "object", - "properties": { - "modal": { - "type": "string", - "enum": [ - "audio", - "image", - "text", - "video" - ] - }, - "cost": { - "type": "number" - } - }, - "required": [ - "cost", - "modal" - ] - }, - "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." + "input_cost": { + "type": "number", + "description": "Defines the cost per 1M tokens in your prompt." }, - "output_cost_list": { + "mistral_format": { + "type": "string", + "enum": [ + "ollama", + "openai" + ], + "description": "If using mistral provider, select the upstream message format." + }, + "dashscope": { + "type": "object", + "properties": { + "international": { + "type": "boolean", + "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", + "default": true + } + } + }, + "input_cost_list": { "type": "array", "items": { "type": "object", @@ -1356,62 +1417,68 @@ }, "required": [ "cost", - "modal" - ] - }, - "description": "Per-modality override of `output_cost`, in cost per 1M output tokens. Set it for models that price each modality separately." - }, - "cache_write_cost_list": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ttl": { - "type": "string" - }, - "cost": { - "type": "number" - } - }, - "required": [ - "cost", - "ttl" + "modal" ] }, - "description": "Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this if the upstream provider charges differently for different cache TTLs, as Anthropic does for 5m and 1h TTLs." + "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." }, - "anthropic_version": { + "azure_foundry_resource": { "type": "string", - "description": "Defines the schema/API version, if using Anthropic provider." + "description": "Resource name for Azure Foundry hosted models." }, - "azure_api_version": { - "type": "string", - "description": "'api-version' for Azure OpenAI instances.", - "default": "2023-05-15" + "huggingface": { + "type": "object", + "properties": { + "use_cache": { + "type": "boolean", + "description": "Use the cache layer on the inference API" + }, + "wait_for_model": { + "type": "boolean", + "description": "Wait for the model if it is not ready" + } + } }, - "azure_foundry_path_prefix": { - "type": "string", - "enum": [ - "/anthropic/v1", - "/openai/v1" - ], - "description": "Path prefix for Azure Foundry hosted models.", - "default": "/openai/v1" + "cohere": { + "type": "object", + "properties": { + "api_version": { + "type": "string", + "enum": [ + "v1", + "v2" + ], + "description": "Cohere API version for chat route type: v1 (legacy, /v1/chat) or v2 (default, /v2/chat, supports tools).", + "default": "v2" + }, + "embedding_input_type": { + "type": "string", + "enum": [ + "classification", + "clustering", + "image", + "search_document", + "search_query" + ], + "description": "The purpose of the input text to calculate embedding vectors.", + "default": "classification" + }, + "wait_for_model": { + "type": "boolean", + "description": "Wait for the model if it is not ready" + } + } }, - "dashscope": { + "kimi": { "type": "object", "properties": { "international": { "type": "boolean", - "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", + "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", "default": true } } }, - "input_cost": { - "type": "number", - "description": "Defines the cost per 1M tokens in your prompt." - }, "cache_read_cost_list": { "type": "array", "items": { @@ -1437,23 +1504,28 @@ }, "description": "Per-modality override of `cache_read_cost`, in cost per 1M cache-read prompt tokens. Set it for models that price each modality separately." }, - "top_k": { - "type": "integer", - "maximum": 500, - "minimum": 0, - "description": "Defines the top-k most likely tokens, if supported." - }, - "azure_instance": { - "type": "string", - "description": "Instance name for Azure OpenAI hosted models." - }, - "mistral_format": { - "type": "string", - "enum": [ - "ollama", - "openai" - ], - "description": "If using mistral provider, select the upstream message format." + "context_window_factor": { + "type": "array", + "items": { + "type": "object", + "properties": { + "above": { + "type": "string" + }, + "input_factor": { + "type": "number" + }, + "output_factor": { + "type": "number" + } + }, + "required": [ + "above", + "input_factor", + "output_factor" + ] + }, + "description": "Above an input-token threshold, scale input/output pricing with the corresponding factor." }, "service_tier_factor": { "type": "array", @@ -1476,28 +1548,50 @@ }, "description": "Multiplier applied to the whole request for a service tier. No need to configure a standard/default tier, as the default factor is 1.0 if none of the tier is matched." }, - "kimi": { - "type": "object", - "properties": { - "international": { - "type": "boolean", - "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", - "default": true - } - } + "temperature": { + "type": "number", + "maximum": 5, + "minimum": 0, + "description": "Defines the matching temperature, if using chat or completion models." }, - "output_cost": { + "anthropic_version": { + "type": "string", + "description": "Defines the schema/API version, if using Anthropic provider." + }, + "cache_write_cost": { "type": "number", - "description": "Defines the cost per 1M tokens in the output of the AI." + "description": "Defines the cost per 1M cache-write prompt tokens." }, - "azure_foundry_domain": { + "top_k": { + "type": "integer", + "maximum": 500, + "minimum": 0, + "description": "Defines the top-k most likely tokens, if supported." + }, + "azure_service": { "type": "string", - "description": "Domain for Azure Foundry hosted models.", - "default": "services.ai.azure.com" + "enum": [ + "azure-foundry", + "azure-openai" + ], + "description": "Service type for Azure provider models.", + "default": "azure-openai" + }, + "max_tokens": { + "type": "integer", + "description": "Defines the max_tokens, if using chat or completion models." + }, + "azure_deployment_id": { + "type": "string", + "description": "Deployment ID for Azure OpenAI instances." }, "bedrock": { "type": "object", "properties": { + "aws_region": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." + }, "aws_assume_role_arn": { "type": "string", "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." @@ -1506,64 +1600,30 @@ "type": "string", "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." }, - "aws_sts_endpoint_url": { + "performance_config_latency": { "type": "string", - "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." - }, - "embeddings_normalize": { - "type": "boolean", - "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", - "default": false + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." }, "video_output_s3_uri": { "type": "string", "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." }, - "batch_role_arn": { - "type": "string", - "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." - }, - "aws_region": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." - }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." - }, "batch_bucket_prefix": { "type": "string", "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." - } - } - }, - "cohere": { - "type": "object", - "properties": { - "api_version": { + }, + "batch_role_arn": { "type": "string", - "enum": [ - "v1", - "v2" - ], - "description": "Cohere API version for chat route type: v1 (legacy, /v1/chat) or v2 (default, /v2/chat, supports tools).", - "default": "v2" + "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." }, - "embedding_input_type": { + "aws_sts_endpoint_url": { "type": "string", - "enum": [ - "classification", - "clustering", - "image", - "search_document", - "search_query" - ], - "description": "The purpose of the input text to calculate embedding vectors.", - "default": "classification" + "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." }, - "wait_for_model": { + "embeddings_normalize": { "type": "boolean", - "description": "Wait for the model if it is not ready" + "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", + "default": false } } } @@ -1599,39 +1659,11 @@ "name": { "type": "string", "description": "Model name to execute." - }, - "model_alias": { - "type": "string", - "description": "The model name parameter from the request that this model should map to." } }, "required": [ "provider" ] - }, - "logging": { - "type": "object", - "properties": { - "opentelemetry_attribute_keys_format": { - "type": "string", - "enum": [ - "openinference", - "openllmetry" - ], - "description": "Sets the keys standard to be used for OpenTelemetry trace attributes and metrics.", - "default": "openllmetry" - }, - "log_statistics": { - "type": "boolean", - "description": "If enabled and supported by the driver, will add model usage and token metrics into the Kong log policy(s) output.", - "default": false - }, - "log_payloads": { - "type": "boolean", - "description": "If enabled, will log the request and response body into the Kong log policy(s) output.Furthermore if Opentelemetry instrumentation is enabled the traces will contain this data as well.", - "default": false - } - } } }, "required": [ @@ -1645,7 +1677,7 @@ "targets" ] }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -1653,9 +1685,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -1663,9 +1695,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -1673,9 +1705,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer_group": { + "service": { "type": "object", "properties": { "id": { @@ -1683,7 +1715,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiRagInjector.json b/app/_schemas/ai-gateway/policies/AiRagInjector.json index cde0ad7c3f4..ece86dea719 100644 --- a/app/_schemas/ai-gateway/policies/AiRagInjector.json +++ b/app/_schemas/ai-gateway/policies/AiRagInjector.json @@ -1,8 +1,49 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "global_acl_config": { + "type": "object", + "properties": { + "allow": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Consumer identifiers allowed access (groups, IDs, usernames, or custom IDs based on consumer_identifier setting)", + "default": [] + }, + "deny": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Consumer identifiers denied access (groups, IDs, usernames, or custom IDs based on consumer_identifier setting)", + "default": [] + } + }, + "description": "Global ACL configuration for all RAG operations" + }, "collection_acl_config": { "type": "object", "additionalProperties": { @@ -28,44 +69,39 @@ }, "description": "Per-collection ACL overrides" }, - "stop_on_filter_error": { - "type": "boolean", - "description": "Default behavior when filter parsing fails (can be overridden per-request)", - "default": false - }, - "consumer_identifier": { + "filter_mode": { "type": "string", "enum": [ - "consumer_group", - "consumer_id", - "custom_id", - "username" + "compatible", + "strict" ], - "description": "The type of consumer identifier used for ACL checks", - "default": "consumer_group" + "description": "Defines how the policy behaves when a filter is invalid. Set to `compatible` to ignore invalid filters, or `strict` to raise an error. This can be overridden per request.", + "default": "compatible" }, "stop_on_failure": { "type": "boolean", "description": "Halt the LLM request process in case of a vectordb or embeddings service failure", "default": false }, - "inject_template": { - "type": "string", - "default": "\n" - }, - "fetch_chunks_count": { - "type": "number", - "description": "The maximum number of chunks to fetch from vectordb", - "default": 5 - }, - "vectordb_namespace": { - "type": "string", - "description": "The namespace of the vectordb to use for embeddings lookup", - "default": "kong_rag_injector" - }, "vectordb": { "type": "object", "properties": { + "strategy": { + "type": "string", + "enum": [ + "pgvector", + "redis" + ], + "description": "which vector database driver to use" + }, + "dimensions": { + "type": "integer", + "description": "the desired dimensionality for the vectors" + }, + "threshold": { + "type": "number", + "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." + }, "distance_metric": { "type": "string", "enum": [ @@ -77,128 +113,20 @@ "redis": { "type": "object", "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, "password": { "type": "string", "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-encrypted": true, - "x-referenceable": true - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "sentinel_username": { "type": "string", "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-encrypted": true, - "x-referenceable": true - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, "cloud_authentication": { "type": "object", "properties": { - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, "auth_provider": { "type": "string", "enum": [ @@ -209,9 +137,9 @@ "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_cache_name": { + "aws_region": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, "aws_access_key_id": { @@ -220,61 +148,67 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_secret_access_key": { + "azure_client_id": { "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_assume_role_arn": { + "azure_client_secret": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "azure_tenant_id": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-encrypted": true, + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "azure_client_secret": { + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_secret_access_key": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "azure_tenant_id": { + "aws_assume_role_arn": { "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-encrypted": true, + "x-referenceable": true }, - "aws_region": { + "aws_role_session_name": { "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-encrypted": true, "x-referenceable": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_nodes": { + "cluster_nodes": { "type": "array", "items": { "type": "object", "properties": { - "host": { + "ip": { "type": "string", "description": "A string representing a host name, such as example.com.", "default": "127.0.0.1" @@ -289,50 +223,160 @@ } }, "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "cluster_nodes": { + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "sentinel_nodes": { "type": "array", "items": { "type": "object", "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, "port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 6379 - }, - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" } } }, "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false } } }, "pgvector": { "type": "object", "properties": { + "database": { + "type": "string", + "description": "the database of the pgvector database", + "default": "kong-pgvector" + }, + "ssl_verify": { + "type": "boolean", + "description": "whether to verify ssl for the pgvector database", + "default": true + }, + "ssl_cert_key": { + "type": "string", + "description": "the path of ssl cert key to use for the pgvector database" + }, "port": { "type": "integer", "description": "the port of the pgvector database", "default": 5432 }, - "user": { - "type": "string", - "description": "the user of the pgvector database", - "default": "postgres", - "x-referenceable": true - }, - "database": { - "type": "string", - "description": "the database of the pgvector database", - "default": "kong-pgvector" + "timeout": { + "type": "number", + "description": "the timeout of the pgvector database", + "default": 5000 }, "ssl": { "type": "boolean", @@ -358,48 +402,24 @@ "type": "string", "description": "the path of ssl cert to use for the pgvector database" }, - "ssl_cert_key": { - "type": "string", - "description": "the path of ssl cert key to use for the pgvector database" - }, "host": { "type": "string", "description": "the host of the pgvector database", "default": "127.0.0.1" }, - "password": { + "user": { "type": "string", - "description": "the password of the pgvector database", - "x-encrypted": true, + "description": "the user of the pgvector database", + "default": "postgres", "x-referenceable": true }, - "timeout": { - "type": "number", - "description": "the timeout of the pgvector database", - "default": 5000 - }, - "ssl_verify": { - "type": "boolean", - "description": "whether to verify ssl for the pgvector database", - "default": true + "password": { + "type": "string", + "description": "the password of the pgvector database", + "x-referenceable": true, + "x-encrypted": true } } - }, - "strategy": { - "type": "string", - "enum": [ - "pgvector", - "redis" - ], - "description": "which vector database driver to use" - }, - "dimensions": { - "type": "integer", - "description": "the desired dimensionality for the vectors" - }, - "threshold": { - "type": "number", - "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." } }, "required": [ @@ -411,6 +431,17 @@ "proxy_config": { "type": "object", "properties": { + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, "no_proxy": { "type": "string", "description": "Comma-separated list of hosts that should not be proxied." @@ -442,17 +473,6 @@ ], "description": "The proxy scheme to use when connecting. Only `http` is supported.", "default": "http" - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true } } }, @@ -463,14 +483,21 @@ "description": "Maximum number of filter clauses allowed", "default": 100 }, - "filter_mode": { + "stop_on_filter_error": { + "type": "boolean", + "description": "Default behavior when filter parsing fails (can be overridden per-request)", + "default": false + }, + "consumer_identifier": { "type": "string", "enum": [ - "compatible", - "strict" + "consumer_group", + "consumer_id", + "custom_id", + "username" ], - "description": "Defines how the policy behaves when a filter is invalid. Set to `compatible` to ignore invalid filters, or `strict` to raise an error. This can be overridden per request.", - "default": "compatible" + "description": "The type of consumer identifier used for ACL checks", + "default": "consumer_group" }, "inject_as_role": { "type": "string", @@ -481,32 +508,60 @@ ], "default": "user" }, + "inject_template": { + "type": "string", + "default": "\n" + }, + "fetch_chunks_count": { + "type": "number", + "description": "The maximum number of chunks to fetch from vectordb", + "default": 5 + }, + "vectordb_namespace": { + "type": "string", + "description": "The namespace of the vectordb to use for embeddings lookup", + "default": "kong_rag_injector" + }, "embeddings": { "type": "object", "properties": { "auth": { "type": "object", "properties": { - "param_name": { + "param_value": { "type": "string", - "description": "If AI model requires authentication via query parameter, specify its name here.", - "x-referenceable": true + "description": "Specify the full parameter value for 'param_name'.", + "x-referenceable": true, + "x-encrypted": true + }, + "param_location": { + "type": "string", + "enum": [ + "body", + "query" + ], + "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." }, "azure_use_managed_identity": { "type": "boolean", "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", "default": false }, - "aws_access_key_id": { + "gcp_use_service_account": { + "type": "boolean", + "description": "Use service account auth for GCP-based providers and models.", + "default": false + }, + "gcp_oauth_token_url": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-encrypted": true, + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", "x-referenceable": true }, - "allow_override": { - "type": "boolean", - "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", - "default": false + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true }, "gcp_workload_identity_federation_auth_json": { "type": "string", @@ -514,58 +569,57 @@ "x-referenceable": true, "x-encrypted": true }, - "azure_tenant_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", - "x-referenceable": true - }, - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false - }, - "gcp_oauth_token_url": { + "param_name": { "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "description": "If AI model requires authentication via query parameter, specify its name here.", "x-referenceable": true }, - "header_value": { + "azure_client_secret": { "type": "string", - "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", "x-encrypted": true, "x-referenceable": true }, - "param_value": { - "type": "string", - "description": "Specify the full parameter value for 'param_name'.", - "x-referenceable": true, - "x-encrypted": true - }, "aws_session_token": { "type": "string", "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, - "param_location": { + "allow_override": { + "type": "boolean", + "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "default": false + }, + "gcp_workload_identity_federation_source": { "type": "string", "enum": [ - "body", - "query" + "aws_iam", + "off" ], - "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." }, "azure_client_id": { "type": "string", "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", "x-referenceable": true }, - "azure_client_secret": { + "azure_tenant_id": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "x-referenceable": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", "x-referenceable": true, "x-encrypted": true }, + "header_name": { + "type": "string", + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", + "x-referenceable": true + }, "gcp_service_account_json": { "type": "string", "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", @@ -577,59 +631,27 @@ "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", "x-referenceable": true }, - "aws_secret_access_key": { + "header_value": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", "x-referenceable": true, "x-encrypted": true - }, - "gcp_workload_identity_federation_source": { - "type": "string", - "enum": [ - "aws_iam", - "off" - ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." - }, - "header_name": { - "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", - "x-referenceable": true } } }, "model": { "type": "object", "properties": { - "provider": { - "type": "string", - "enum": [ - "azure", - "bedrock", - "databricks", - "gemini", - "huggingface", - "mistral", - "ollama", - "openai", - "vercel" - ], - "description": "AI provider format to use for embeddings API" - }, - "name": { - "type": "string", - "description": "Model name to execute." - }, "options": { "type": "object", "properties": { - "upstream_url": { - "type": "string", - "description": "upstream url for the embeddings" - }, "azure": { "type": "object", "properties": { + "instance": { + "type": "string", + "description": "Instance name for Azure OpenAI hosted models." + }, "api_version": { "type": "string", "description": "'api-version' for Azure OpenAI instances.", @@ -638,10 +660,6 @@ "deployment_id": { "type": "string", "description": "Deployment ID for Azure OpenAI instances." - }, - "instance": { - "type": "string", - "description": "Instance name for Azure OpenAI hosted models." } } }, @@ -652,19 +670,6 @@ "type": "string", "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." }, - "embeddings_normalize": { - "type": "boolean", - "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", - "default": false - }, - "batch_bucket_prefix": { - "type": "string", - "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." - }, - "aws_assume_role_arn": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." - }, "performance_config_latency": { "type": "string", "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." @@ -681,9 +686,22 @@ "type": "string", "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." }, + "aws_assume_role_arn": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + }, "aws_role_session_name": { "type": "string", "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + }, + "embeddings_normalize": { + "type": "boolean", + "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", + "default": false + }, + "batch_bucket_prefix": { + "type": "string", + "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." } } }, @@ -725,9 +743,32 @@ "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." } } + }, + "upstream_url": { + "type": "string", + "description": "upstream url for the embeddings" } }, "description": "Key/value settings for the model" + }, + "provider": { + "type": "string", + "enum": [ + "azure", + "bedrock", + "databricks", + "gemini", + "huggingface", + "mistral", + "ollama", + "openai", + "vercel" + ], + "description": "AI provider format to use for embeddings API" + }, + "name": { + "type": "string", + "description": "Model name to execute." } }, "required": [ @@ -739,28 +780,6 @@ "required": [ "model" ] - }, - "global_acl_config": { - "type": "object", - "properties": { - "allow": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Consumer identifiers allowed access (groups, IDs, usernames, or custom IDs based on consumer_identifier setting)", - "default": [] - }, - "deny": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Consumer identifiers denied access (groups, IDs, usernames, or custom IDs based on consumer_identifier setting)", - "default": [] - } - }, - "description": "Global ACL configuration for all RAG operations" } }, "required": [ @@ -768,25 +787,6 @@ "vectordb" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/AiRateLimitingAdvanced.json b/app/_schemas/ai-gateway/policies/AiRateLimitingAdvanced.json index 7fd64d38529..d259652b48f 100644 --- a/app/_schemas/ai-gateway/policies/AiRateLimitingAdvanced.json +++ b/app/_schemas/ai-gateway/policies/AiRateLimitingAdvanced.json @@ -1,330 +1,13 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "disable_penalty": { + "decrease_by_fractions_in_redis": { "type": "boolean", - "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type and the request prompt provider.", + "description": "By default, Kong decreates the AI rate limiting counters by whole number in Redis. This setting allows to decrease the counters by float number.", "default": false }, - "error_code": { - "type": "number", - "description": "Set a custom error code to return when the rate limit is exceeded.", - "default": 429 - }, - "error_message": { - "type": "string", - "description": "Set a custom error message to return when the rate limit is exceeded.", - "default": "AI token rate limit exceeded for provider(s): " - }, - "strategy": { - "type": "string", - "enum": [ - "cluster", - "local", - "redis" - ], - "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local`, `redis` and `cluster`.", - "default": "local" - }, - "path": { - "type": "string", - "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." - }, - "request_prompt_count_function": { - "type": "string", - "description": "If defined, it use custom function to count requests for the request prompt provider" - }, - "tokens_count_strategy": { - "type": "string", - "enum": [ - "completion_tokens", - "cost", - "prompt_tokens", - "total_tokens" - ], - "description": "What tokens to use for cost calculation. Available values are: `total_tokens` `prompt_tokens`, `completion_tokens` or `cost`.", - "default": "total_tokens" - }, - "redis": { - "type": "object", - "properties": { - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, - "cloud_authentication": { - "type": "object", - "properties": { - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-encrypted": true, - "x-referenceable": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_assume_role_arn": { - "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_role_session_name": { - "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-encrypted": true, - "x-referenceable": true - }, - "azure_client_secret": { - "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - } - }, - "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - }, - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true - }, - "sentinel_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - } - } - }, - "custom_cost_count_function": { - "type": "string", - "description": "If defined, it uses custom function to generate cost for the inference request" - }, - "identifier": { - "type": "string", - "enum": [ - "consumer", - "consumer-group", - "credential", - "header", - "ip", - "path", - "service" - ], - "description": "The type of identifier used to generate the rate limit key. Defines the scope used to increment the rate limiting counters. Can be `ip`, `credential`, `consumer`, `service`, `header`, `path` or `consumer-group`. Note if `identifier` is `consumer-group`, the policy must be applied on a consumer group entity. Because a consumer may belong to multiple consumer groups, the policy needs to know explicitly which consumer group to limit the rate.", - "default": "consumer" - }, "policies": { "type": "array", "items": { @@ -433,47 +116,300 @@ "limit" ] }, - "minLength": 1, - "description": "Rate limits to enforce when this policy matches." + "minLength": 1, + "description": "Rate limits to enforce when this policy matches." + }, + "window_type": { + "type": "string", + "enum": [ + "calendar", + "fixed", + "sliding" + ], + "description": "The time window type for this policy.", + "default": "sliding" + }, + "timezone": { + "type": "string", + "description": "IANA timezone used for calendar window boundaries." + } + } + }, + "minLength": 1, + "description": "Policy-based rate limiting. Each policy defines match conditions and limits." + }, + "strategy": { + "type": "string", + "enum": [ + "cluster", + "local", + "redis" + ], + "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local`, `redis` and `cluster`.", + "default": "local" + }, + "retry_after_jitter_max": { + "type": "number", + "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.", + "default": 0 + }, + "header_name": { + "type": "string", + "description": "A string representing an HTTP header name." + }, + "path": { + "type": "string", + "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." + }, + "redis": { + "type": "object", + "properties": { + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-encrypted": true, + "x-referenceable": true + }, + "cloud_authentication": { + "type": "object", + "properties": { + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "auth_provider": { + "type": "string", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + } }, - "window_type": { - "type": "string", - "enum": [ - "calendar", - "fixed", - "sliding" - ], - "description": "The time window type for this policy.", - "default": "sliding" + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } }, - "timezone": { - "type": "string", - "description": "IANA timezone used for calendar window boundaries." - } + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true } - }, - "minLength": 1, - "description": "Policy-based rate limiting. Each policy defines match conditions and limits." - }, - "hide_client_headers": { - "type": "boolean", - "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.", - "default": false - }, - "retry_after_jitter_max": { - "type": "number", - "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.", - "default": 0 + } }, - "error_hide_providers": { + "disable_penalty": { "type": "boolean", - "description": "Optionally hide informative response that would otherwise provide information about the provider in the error message.", + "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type and the request prompt provider.", "default": false }, - "decrease_by_fractions_in_redis": { - "type": "boolean", - "description": "By default, Kong decreates the AI rate limiting counters by whole number in Redis. This setting allows to decrease the counters by float number.", - "default": false + "custom_cost_count_function": { + "type": "string", + "description": "If defined, it uses custom function to generate cost for the inference request" }, "window_type": { "type": "string", @@ -484,9 +420,26 @@ "description": "Sets the time window type to either `sliding` (default) or `fixed`. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window's counters.", "default": "sliding" }, - "sync_rate": { + "error_code": { "type": "number", - "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms)." + "description": "Set a custom error code to return when the rate limit is exceeded.", + "default": 429 + }, + "error_message": { + "type": "string", + "description": "Set a custom error message to return when the rate limit is exceeded.", + "default": "AI token rate limit exceeded for provider(s): " + }, + "tokens_count_strategy": { + "type": "string", + "enum": [ + "completion_tokens", + "cost", + "prompt_tokens", + "total_tokens" + ], + "description": "What tokens to use for cost calculation. Available values are: `total_tokens` `prompt_tokens`, `completion_tokens` or `cost`.", + "default": "total_tokens" }, "namespace": { "type": "string", @@ -497,16 +450,63 @@ "description": "The shared dictionary where counters are stored. When the policy is configured to synchronize counter data externally (that is `config.strategy` is `cluster` or `redis` and `config.sync_rate` isn't `-1`), this dictionary serves as a buffer to populate counters in the data store on each synchronization cycle. The dictionary must be defined in the nginx configuration using `lua_shared_dict` directive (e.g., `lua_shared_dict kong_rate_limiting_counters 12m`).", "default": "kong_rate_limiting_counters" }, - "header_name": { + "hide_client_headers": { + "type": "boolean", + "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.", + "default": false + }, + "request_prompt_count_function": { "type": "string", - "description": "A string representing an HTTP header name." + "description": "If defined, it use custom function to count requests for the request prompt provider" + }, + "identifier": { + "type": "string", + "enum": [ + "consumer", + "consumer-group", + "credential", + "header", + "ip", + "path", + "service" + ], + "description": "The type of identifier used to generate the rate limit key. Defines the scope used to increment the rate limiting counters. Can be `ip`, `credential`, `consumer`, `service`, `header`, `path` or `consumer-group`. Note if `identifier` is `consumer-group`, the policy must be applied on a consumer group entity. Because a consumer may belong to multiple consumer groups, the policy needs to know explicitly which consumer group to limit the rate.", + "default": "consumer" + }, + "sync_rate": { + "type": "number", + "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms)." + }, + "error_hide_providers": { + "type": "boolean", + "description": "Optionally hide informative response that would otherwise provide information about the provider in the error message.", + "default": false } }, "required": [ "policies" ] }, - "route": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "consumer": { "type": "object", "properties": { "id": { @@ -514,9 +514,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -524,9 +524,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -534,9 +534,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer_group": { + "service": { "type": "object", "properties": { "id": { @@ -544,7 +544,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiRequestTransformer.json b/app/_schemas/ai-gateway/policies/AiRequestTransformer.json index 3df1f6bdf3e..1e8413a66bd 100644 --- a/app/_schemas/ai-gateway/policies/AiRequestTransformer.json +++ b/app/_schemas/ai-gateway/policies/AiRequestTransformer.json @@ -22,6 +22,29 @@ "config": { "type": "object", "properties": { + "prompt": { + "type": "string", + "description": "Use this prompt to tune the LLM system/assistant message for the incoming proxy request (from the client), and what you are expecting in return." + }, + "transformation_extract_pattern": { + "type": "string", + "description": "Defines the regular expression that must match to indicate a successful AI transformation at the request phase. The first match will be set as the outgoing body. If the AI service's response doesn't match this pattern, it is marked as a failure." + }, + "http_timeout": { + "type": "integer", + "description": "Timeout in milliseconds for the AI upstream service.", + "default": 60000 + }, + "https_verify": { + "type": "boolean", + "description": "Verify the TLS certificate of the AI upstream service.", + "default": true + }, + "max_request_body_size": { + "type": "integer", + "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", + "default": 8388608 + }, "proxy_config": { "type": "object", "properties": { @@ -73,6 +96,24 @@ "llm": { "type": "object", "properties": { + "weight": { + "type": "integer", + "maximum": 65535, + "minimum": 1, + "description": "The weight this target gets within the upstream loadbalancer (1-65535). Only used by ai-proxy-advanced.", + "default": 100 + }, + "description": { + "type": "string", + "description": "The semantic description of the target, required if using semantic load balancing. Specially, setting this to 'CATCHALL' will indicate such target to be used when no other targets match the semantic threshold. Only used by ai-proxy-advanced." + }, + "metadata": { + "type": "object", + "additionalProperties": true, + "description": "For internal use only. ", + "nullable": true, + "x-speakeasy-type-override": "any" + }, "route_type": { "type": "string", "enum": [ @@ -98,44 +139,21 @@ "auth": { "type": "object", "properties": { - "aws_access_key_id": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "header_name": { + "azure_tenant_id": { "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", "x-referenceable": true }, - "param_location": { - "type": "string", - "enum": [ - "body", - "query" - ], - "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." - }, - "aws_session_token": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_workload_identity_federation_source": { + "gcp_oauth_token_url": { "type": "string", - "enum": [ - "aws_iam", - "off" - ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true }, - "gcp_workload_identity_federation_auth_json": { + "aws_secret_access_key": { "type": "string", - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", - "x-referenceable": true, - "x-encrypted": true + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "x-encrypted": true, + "x-referenceable": true }, "header_value": { "type": "string", @@ -158,54 +176,77 @@ "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", "default": false }, - "param_name": { + "header_name": { "type": "string", - "description": "If AI model requires authentication via query parameter, specify its name here.", + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", "x-referenceable": true }, - "param_value": { + "azure_client_secret": { "type": "string", - "description": "Specify the full parameter value for 'param_name'.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_workload_identity_federation_auth_json": { + "type": "string", + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", "x-referenceable": true, "x-encrypted": true }, + "param_location": { + "type": "string", + "enum": [ + "body", + "query" + ], + "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." + }, "azure_client_id": { "type": "string", "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", "x-referenceable": true }, - "azure_client_secret": { + "gcp_service_account_json": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", "x-referenceable": true, "x-encrypted": true }, - "azure_tenant_id": { + "aws_access_key_id": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", - "x-referenceable": true + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true }, - "gcp_oauth_token_url": { + "aws_session_token": { "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", - "x-referenceable": true + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "x-referenceable": true, + "x-encrypted": true }, - "aws_secret_access_key": { + "gcp_workload_identity_federation_source": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-encrypted": true, + "enum": [ + "aws_iam", + "off" + ], + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." + }, + "param_name": { + "type": "string", + "description": "If AI model requires authentication via query parameter, specify its name here.", "x-referenceable": true }, + "param_value": { + "type": "string", + "description": "Specify the full parameter value for 'param_name'.", + "x-referenceable": true, + "x-encrypted": true + }, "azure_use_managed_identity": { "type": "boolean", "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", "default": false - }, - "gcp_service_account_json": { - "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", - "x-referenceable": true, - "x-encrypted": true } } }, @@ -249,61 +290,62 @@ "options": { "type": "object", "properties": { - "azure_foundry_domain": { - "type": "string", - "description": "Domain for Azure Foundry hosted models.", - "default": "services.ai.azure.com" - }, - "azure_foundry_path_prefix": { - "type": "string", - "enum": [ - "/anthropic/v1", - "/openai/v1" - ], - "description": "Path prefix for Azure Foundry hosted models.", - "default": "/openai/v1" - }, - "bedrock": { - "type": "object", - "properties": { - "batch_bucket_prefix": { - "type": "string", - "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." - }, - "aws_assume_role_arn": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." - }, - "embeddings_normalize": { - "type": "boolean", - "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", - "default": false - }, - "video_output_s3_uri": { - "type": "string", - "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." - }, - "batch_role_arn": { - "type": "string", - "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." - }, - "aws_region": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." - }, - "aws_role_session_name": { - "type": "string", - "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + "input_cost_list": { + "type": "array", + "items": { + "type": "object", + "properties": { + "modal": { + "type": "string", + "enum": [ + "audio", + "image", + "text", + "video" + ] + }, + "cost": { + "type": "number" + } }, - "aws_sts_endpoint_url": { - "type": "string", - "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." + "required": [ + "cost", + "modal" + ] + }, + "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." + }, + "service_tier_factor": { + "type": "array", + "items": { + "type": "object", + "properties": { + "tier": { + "type": "string", + "minLength": 1, + "description": "A word matched case-insensitively as a substring of the vendor's reported service tier (e.g. 'priority', 'flex', or 'throughput' for Gemini/Vertex's PROVISIONED_THROUGHPUT). If several entries match, the longest (most specific) wins; array order doesn't matter. Configure 'priority' will also match 'fast' (whole word) as OpenAI returns either 'priority' or 'fast' for priority service tier." + }, + "factor": { + "type": "number" + } }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." - } - } + "required": [ + "factor", + "tier" + ] + }, + "description": "Multiplier applied to the whole request for a service tier. No need to configure a standard/default tier, as the default factor is 1.0 if none of the tier is matched." + }, + "temperature": { + "type": "number", + "maximum": 5, + "minimum": 0, + "description": "Defines the matching temperature, if using chat or completion models." + }, + "azure_api_version": { + "type": "string", + "description": "'api-version' for Azure OpenAI instances.", + "default": "2023-05-15" }, "cohere": { "type": "object", @@ -335,44 +377,38 @@ } } }, - "sagemaker": { + "kimi": { "type": "object", "properties": { - "target_model": { - "type": "string", - "description": "Sets the X-Amzn-SageMaker-Target-Model header for multi-model endpoints." - }, - "target_variant": { - "type": "string", - "description": "Sets the X-Amzn-SageMaker-Target-Variant header for A/B variant testing." - }, - "target_container_hostname": { - "type": "string", - "description": "Sets the X-Amzn-SageMaker-Target-Container-Hostname header for multi-container endpoints." - }, - "aws_region": { - "type": "string", - "description": "Override the `AWS_REGION` environment variable for SageMaker requests." - }, - "aws_assume_role_arn": { - "type": "string", - "description": "Assume a different IAM role after authentication." - }, - "aws_role_session_name": { - "type": "string", - "description": "Identifier for the assumed role session." - }, - "aws_sts_endpoint_url": { - "type": "string", - "description": "Override the STS endpoint URL when assuming a different role." + "international": { + "type": "boolean", + "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", + "default": true } } }, - "output_cost_list": { + "azure_deployment_id": { + "type": "string", + "description": "Deployment ID for Azure OpenAI instances." + }, + "top_k": { + "type": "integer", + "maximum": 500, + "minimum": 0, + "description": "Defines the top-k most likely tokens, if supported." + }, + "output_cost": { + "type": "number", + "description": "Defines the cost per 1M tokens in the output of the AI." + }, + "cache_read_cost_list": { "type": "array", "items": { "type": "object", "properties": { + "cost": { + "type": "number" + }, "modal": { "type": "string", "enum": [ @@ -381,9 +417,6 @@ "text", "video" ] - }, - "cost": { - "type": "number" } }, "required": [ @@ -391,112 +424,76 @@ "modal" ] }, - "description": "Per-modality override of `output_cost`, in cost per 1M output tokens. Set it for models that price each modality separately." + "description": "Per-modality override of `cache_read_cost`, in cost per 1M cache-read prompt tokens. Set it for models that price each modality separately." }, - "cache_write_cost_list": { + "context_window_factor": { "type": "array", "items": { "type": "object", "properties": { - "ttl": { + "output_factor": { + "type": "number" + }, + "above": { "type": "string" }, - "cost": { + "input_factor": { "type": "number" } }, "required": [ - "cost", - "ttl" + "above", + "input_factor", + "output_factor" ] }, - "description": "Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this if the upstream provider charges differently for different cache TTLs, as Anthropic does for 5m and 1h TTLs." - }, - "top_p": { - "type": "number", - "maximum": 1, - "minimum": 0, - "description": "Defines the top-p probability mass, if supported." + "description": "Above an input-token threshold, scale input/output pricing with the corresponding factor." }, "anthropic_version": { "type": "string", "description": "Defines the schema/API version, if using Anthropic provider." }, - "mistral_format": { + "azure_foundry_path_prefix": { "type": "string", "enum": [ - "ollama", - "openai" + "/anthropic/v1", + "/openai/v1" ], - "description": "If using mistral provider, select the upstream message format." + "description": "Path prefix for Azure Foundry hosted models.", + "default": "/openai/v1" }, - "dashscope": { - "type": "object", - "properties": { - "international": { - "type": "boolean", - "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", - "default": true - } - } + "upstream_url": { + "type": "string", + "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." }, - "output_cost": { + "input_cost": { "type": "number", - "description": "Defines the cost per 1M tokens in the output of the AI." + "description": "Defines the cost per 1M tokens in your prompt." }, - "kimi": { - "type": "object", - "properties": { - "international": { - "type": "boolean", - "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", - "default": true - } - } + "azure_instance": { + "type": "string", + "description": "Instance name for Azure OpenAI hosted models." }, - "azure_api_version": { + "azure_foundry_resource": { "type": "string", - "description": "'api-version' for Azure OpenAI instances.", - "default": "2023-05-15" + "description": "Resource name for Azure Foundry hosted models." }, - "gemini": { + "databricks": { "type": "object", "properties": { - "api_endpoint": { - "type": "string", - "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." - }, - "project_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the project ID." - }, - "location_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the location ID." - }, - "endpoint_id": { + "workspace_instance_id": { "type": "string", - "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." + "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." } } }, - "input_cost": { - "type": "number", - "description": "Defines the cost per 1M tokens in your prompt." - }, - "input_cost_list": { + "cache_write_cost_list": { "type": "array", "items": { "type": "object", "properties": { - "modal": { - "type": "string", - "enum": [ - "audio", - "image", - "text", - "video" - ] + "ttl": { + "type": "string" }, "cost": { "type": "number" @@ -504,69 +501,62 @@ }, "required": [ "cost", - "modal" + "ttl" ] }, - "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." + "description": "Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this if the upstream provider charges differently for different cache TTLs, as Anthropic does for 5m and 1h TTLs." }, - "temperature": { + "top_p": { "type": "number", - "maximum": 5, + "maximum": 1, "minimum": 0, - "description": "Defines the matching temperature, if using chat or completion models." + "description": "Defines the top-p probability mass, if supported." }, - "top_k": { - "type": "integer", - "maximum": 500, - "minimum": 0, - "description": "Defines the top-k most likely tokens, if supported." + "azure_foundry_domain": { + "type": "string", + "description": "Domain for Azure Foundry hosted models.", + "default": "services.ai.azure.com" }, - "llama2_format": { + "mistral_format": { "type": "string", "enum": [ "ollama", - "openai", - "raw" + "openai" ], - "description": "If using llama2 provider, select the upstream message format." + "description": "If using mistral provider, select the upstream message format." }, - "huggingface": { - "type": "object", - "properties": { - "wait_for_model": { - "type": "boolean", - "description": "Wait for the model if it is not ready" - }, - "use_cache": { - "type": "boolean", - "description": "Use the cache layer on the inference API" - } - } + "embeddings_dimensions": { + "type": "integer", + "description": "If using embeddings models, set the number of dimensions to generate." }, - "cache_read_cost": { + "cache_write_cost": { "type": "number", - "description": "Defines the cost per 1M cache-read (cached) prompt tokens." + "description": "Defines the cost per 1M cache-write prompt tokens." }, - "service_tier_factor": { + "output_cost_list": { "type": "array", "items": { "type": "object", "properties": { - "tier": { + "modal": { "type": "string", - "minLength": 1, - "description": "A word matched case-insensitively as a substring of the vendor's reported service tier (e.g. 'priority', 'flex', or 'throughput' for Gemini/Vertex's PROVISIONED_THROUGHPUT). If several entries match, the longest (most specific) wins; array order doesn't matter. Configure 'priority' will also match 'fast' (whole word) as OpenAI returns either 'priority' or 'fast' for priority service tier." + "enum": [ + "audio", + "image", + "text", + "video" + ] }, - "factor": { + "cost": { "type": "number" } }, "required": [ - "factor", - "tier" + "cost", + "modal" ] }, - "description": "Multiplier applied to the whole request for a service tier. No need to configure a standard/default tier, as the default factor is 1.0 if none of the tier is matched." + "description": "Per-modality override of `output_cost`, in cost per 1M output tokens. Set it for models that price each modality separately." }, "azure_service": { "type": "string", @@ -577,88 +567,139 @@ "description": "Service type for Azure provider models.", "default": "azure-openai" }, - "azure_deployment_id": { - "type": "string", - "description": "Deployment ID for Azure OpenAI instances." - }, - "upstream_url": { - "type": "string", - "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." + "dashscope": { + "type": "object", + "properties": { + "international": { + "type": "boolean", + "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", + "default": true + } + } }, - "cache_read_cost_list": { - "type": "array", - "items": { - "type": "object", - "properties": { - "modal": { - "type": "string", - "enum": [ - "audio", - "image", - "text", - "video" - ] - }, - "cost": { - "type": "number" - } + "sagemaker": { + "type": "object", + "properties": { + "aws_role_session_name": { + "type": "string", + "description": "Identifier for the assumed role session." }, - "required": [ - "cost", - "modal" - ] - }, - "description": "Per-modality override of `cache_read_cost`, in cost per 1M cache-read prompt tokens. Set it for models that price each modality separately." - }, - "context_window_factor": { - "type": "array", - "items": { - "type": "object", - "properties": { - "above": { - "type": "string" - }, - "input_factor": { - "type": "number" - }, - "output_factor": { - "type": "number" - } + "aws_sts_endpoint_url": { + "type": "string", + "description": "Override the STS endpoint URL when assuming a different role." }, - "required": [ - "above", - "input_factor", - "output_factor" - ] - }, - "description": "Above an input-token threshold, scale input/output pricing with the corresponding factor." + "target_model": { + "type": "string", + "description": "Sets the X-Amzn-SageMaker-Target-Model header for multi-model endpoints." + }, + "target_variant": { + "type": "string", + "description": "Sets the X-Amzn-SageMaker-Target-Variant header for A/B variant testing." + }, + "target_container_hostname": { + "type": "string", + "description": "Sets the X-Amzn-SageMaker-Target-Container-Hostname header for multi-container endpoints." + }, + "aws_region": { + "type": "string", + "description": "Override the `AWS_REGION` environment variable for SageMaker requests." + }, + "aws_assume_role_arn": { + "type": "string", + "description": "Assume a different IAM role after authentication." + } + } }, - "azure_foundry_resource": { + "llama2_format": { "type": "string", - "description": "Resource name for Azure Foundry hosted models." + "enum": [ + "ollama", + "openai", + "raw" + ], + "description": "If using llama2 provider, select the upstream message format." }, - "embeddings_dimensions": { - "type": "integer", - "description": "If using embeddings models, set the number of dimensions to generate." + "gemini": { + "type": "object", + "properties": { + "project_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the project ID." + }, + "location_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the location ID." + }, + "endpoint_id": { + "type": "string", + "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." + }, + "api_endpoint": { + "type": "string", + "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." + } + } + }, + "huggingface": { + "type": "object", + "properties": { + "use_cache": { + "type": "boolean", + "description": "Use the cache layer on the inference API" + }, + "wait_for_model": { + "type": "boolean", + "description": "Wait for the model if it is not ready" + } + } }, "max_tokens": { "type": "integer", "description": "Defines the max_tokens, if using chat or completion models." }, - "cache_write_cost": { + "cache_read_cost": { "type": "number", - "description": "Defines the cost per 1M cache-write prompt tokens." - }, - "azure_instance": { - "type": "string", - "description": "Instance name for Azure OpenAI hosted models." + "description": "Defines the cost per 1M cache-read (cached) prompt tokens." }, - "databricks": { + "bedrock": { "type": "object", "properties": { - "workspace_instance_id": { + "aws_region": { "type": "string", - "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." + "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." + }, + "aws_assume_role_arn": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + }, + "aws_sts_endpoint_url": { + "type": "string", + "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." + }, + "embeddings_normalize": { + "type": "boolean", + "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", + "default": false + }, + "performance_config_latency": { + "type": "string", + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." + }, + "video_output_s3_uri": { + "type": "string", + "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." + }, + "batch_role_arn": { + "type": "string", + "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." + }, + "aws_role_session_name": { + "type": "string", + "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + }, + "batch_bucket_prefix": { + "type": "string", + "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." } } } @@ -693,53 +734,12 @@ "default": "openllmetry" } } - }, - "weight": { - "type": "integer", - "maximum": 65535, - "minimum": 1, - "description": "The weight this target gets within the upstream loadbalancer (1-65535). Only used by ai-proxy-advanced.", - "default": 100 - }, - "description": { - "type": "string", - "description": "The semantic description of the target, required if using semantic load balancing. Specially, setting this to 'CATCHALL' will indicate such target to be used when no other targets match the semantic threshold. Only used by ai-proxy-advanced." - }, - "metadata": { - "type": "object", - "additionalProperties": true, - "description": "For internal use only. ", - "nullable": true, - "x-speakeasy-type-override": "any" } }, "required": [ "model", "route_type" ] - }, - "prompt": { - "type": "string", - "description": "Use this prompt to tune the LLM system/assistant message for the incoming proxy request (from the client), and what you are expecting in return." - }, - "transformation_extract_pattern": { - "type": "string", - "description": "Defines the regular expression that must match to indicate a successful AI transformation at the request phase. The first match will be set as the outgoing body. If the AI service's response doesn't match this pattern, it is marked as a failure." - }, - "http_timeout": { - "type": "integer", - "description": "Timeout in milliseconds for the AI upstream service.", - "default": 60000 - }, - "https_verify": { - "type": "boolean", - "description": "Verify the TLS certificate of the AI upstream service.", - "default": true - }, - "max_request_body_size": { - "type": "integer", - "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", - "default": 8388608 } }, "required": [ @@ -747,7 +747,7 @@ "prompt" ] }, - "consumer_group": { + "route": { "type": "object", "properties": { "id": { @@ -755,9 +755,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -765,9 +765,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -775,7 +775,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiResponseTransformer.json b/app/_schemas/ai-gateway/policies/AiResponseTransformer.json index b34c09f8d80..8d5724198b0 100644 --- a/app/_schemas/ai-gateway/policies/AiResponseTransformer.json +++ b/app/_schemas/ai-gateway/policies/AiResponseTransformer.json @@ -1,8 +1,37 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "http_timeout": { + "type": "integer", + "description": "Timeout in milliseconds for the AI upstream service.", + "default": 60000 + }, + "https_verify": { + "type": "boolean", + "description": "Verify the TLS certificate of the AI upstream service.", + "default": true + }, "max_request_body_size": { "type": "integer", "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", @@ -11,25 +40,6 @@ "proxy_config": { "type": "object", "properties": { - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, "http_proxy_port": { "type": "integer", "maximum": 65535, @@ -53,72 +63,46 @@ ], "description": "The proxy scheme to use when connecting. Only `http` is supported.", "default": "http" + }, + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." } } }, "llm": { "type": "object", "properties": { - "route_type": { - "type": "string", - "enum": [ - "audio/v1/audio/speech", - "audio/v1/audio/transcriptions", - "audio/v1/audio/translations", - "image/v1/images/edits", - "image/v1/images/generations", - "llm/v1/assistants", - "llm/v1/batches", - "llm/v1/chat", - "llm/v1/completions", - "llm/v1/embeddings", - "llm/v1/files", - "llm/v1/responses", - "llm/v1/skills", - "passthrough", - "realtime/v1/realtime", - "video/v1/videos/generations" - ], - "description": "The model's operation implementation, for this provider. " - }, "auth": { "type": "object", "properties": { - "azure_use_managed_identity": { - "type": "boolean", - "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", - "default": false - }, - "azure_tenant_id": { + "header_value": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", + "x-encrypted": true, "x-referenceable": true }, - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false - }, - "aws_secret_access_key": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_session_token": { + "param_value": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "description": "Specify the full parameter value for 'param_name'.", "x-referenceable": true, "x-encrypted": true }, - "gcp_workload_identity_federation_source": { - "type": "string", - "enum": [ - "aws_iam", - "off" - ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." - }, "param_location": { "type": "string", "enum": [ @@ -127,10 +111,10 @@ ], "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." }, - "azure_client_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", - "x-referenceable": true + "azure_use_managed_identity": { + "type": "boolean", + "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", + "default": false }, "azure_client_secret": { "type": "string", @@ -138,92 +122,89 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_access_key_id": { + "gcp_oauth_token_url": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true }, - "header_name": { + "gcp_workload_identity_federation_source": { "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", - "x-referenceable": true + "enum": [ + "aws_iam", + "off" + ], + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." }, "param_name": { "type": "string", "description": "If AI model requires authentication via query parameter, specify its name here.", "x-referenceable": true }, - "param_value": { + "gcp_metadata_url": { "type": "string", - "description": "Specify the full parameter value for 'param_name'.", + "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", "x-referenceable": true, "x-encrypted": true }, - "gcp_metadata_url": { + "azure_client_id": { "type": "string", - "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", "x-referenceable": true }, - "allow_override": { + "gcp_use_service_account": { "type": "boolean", - "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "description": "Use service account auth for GCP-based providers and models.", "default": false }, - "header_value": { - "type": "string", - "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", - "x-encrypted": true, - "x-referenceable": true - }, "gcp_service_account_json": { "type": "string", "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", "x-referenceable": true, "x-encrypted": true }, - "gcp_oauth_token_url": { + "gcp_workload_identity_federation_auth_json": { "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", + "x-referenceable": true, + "x-encrypted": true + }, + "header_name": { + "type": "string", + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", "x-referenceable": true }, - "gcp_workload_identity_federation_auth_json": { + "azure_tenant_id": { "type": "string", - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "x-referenceable": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "x-encrypted": true, + "x-referenceable": true + }, + "aws_session_token": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", "x-referenceable": true, "x-encrypted": true + }, + "allow_override": { + "type": "boolean", + "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "default": false } } }, "model": { "type": "object", "properties": { - "provider": { - "type": "string", - "enum": [ - "anthropic", - "azure", - "bedrock", - "cerebras", - "cohere", - "dashscope", - "databricks", - "deepseek", - "gemini", - "huggingface", - "kimi", - "llama2", - "mistral", - "ollama", - "openai", - "sagemaker", - "typesafe", - "vercel", - "vllm", - "xai" - ], - "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats." - }, "name": { "type": "string", "description": "Model name to execute." @@ -235,10 +216,9 @@ "options": { "type": "object", "properties": { - "azure_foundry_domain": { + "azure_deployment_id": { "type": "string", - "description": "Domain for Azure Foundry hosted models.", - "default": "services.ai.azure.com" + "description": "Deployment ID for Azure OpenAI instances." }, "azure_foundry_path_prefix": { "type": "string", @@ -249,116 +229,35 @@ "description": "Path prefix for Azure Foundry hosted models.", "default": "/openai/v1" }, - "llama2_format": { + "mistral_format": { "type": "string", "enum": [ "ollama", - "openai", - "raw" + "openai" ], - "description": "If using llama2 provider, select the upstream message format." + "description": "If using mistral provider, select the upstream message format." }, - "gemini": { - "type": "object", - "properties": { - "api_endpoint": { - "type": "string", - "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." - }, - "project_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the project ID." - }, - "location_id": { - "type": "string", - "description": "If running Gemini on Vertex, specify the location ID." - }, - "endpoint_id": { - "type": "string", - "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." - } - } + "embeddings_dimensions": { + "type": "integer", + "description": "If using embeddings models, set the number of dimensions to generate." }, - "databricks": { + "kimi": { "type": "object", "properties": { - "workspace_instance_id": { - "type": "string", - "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." + "international": { + "type": "boolean", + "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", + "default": true } } }, - "max_tokens": { - "type": "integer", - "description": "Defines the max_tokens, if using chat or completion models." - }, - "cache_read_cost": { - "type": "number", - "description": "Defines the cost per 1M cache-read (cached) prompt tokens." - }, - "cache_read_cost_list": { - "type": "array", - "items": { - "type": "object", - "properties": { - "modal": { - "type": "string", - "enum": [ - "audio", - "image", - "text", - "video" - ] - }, - "cost": { - "type": "number" - } - }, - "required": [ - "cost", - "modal" - ] - }, - "description": "Per-modality override of `cache_read_cost`, in cost per 1M cache-read prompt tokens. Set it for models that price each modality separately." - }, - "top_p": { + "input_cost": { "type": "number", - "maximum": 1, - "minimum": 0, - "description": "Defines the top-p probability mass, if supported." - }, - "azure_deployment_id": { - "type": "string", - "description": "Deployment ID for Azure OpenAI instances." + "description": "Defines the cost per 1M tokens in your prompt." }, - "cache_write_cost": { + "output_cost": { "type": "number", - "description": "Defines the cost per 1M cache-write prompt tokens." - }, - "input_cost_list": { - "type": "array", - "items": { - "type": "object", - "properties": { - "modal": { - "type": "string", - "enum": [ - "audio", - "image", - "text", - "video" - ] - }, - "cost": { - "type": "number" - } - }, - "required": [ - "cost", - "modal" - ] - }, - "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." + "description": "Defines the cost per 1M tokens in the output of the AI." }, "cache_write_cost_list": { "type": "array", @@ -379,27 +278,59 @@ }, "description": "Per-cache-TTL cache-write pricing; overrides cache_write_cost per TTL. Configure this if the upstream provider charges differently for different cache TTLs, as Anthropic does for 5m and 1h TTLs." }, + "top_p": { + "type": "number", + "maximum": 1, + "minimum": 0, + "description": "Defines the top-p probability mass, if supported." + }, "azure_instance": { "type": "string", "description": "Instance name for Azure OpenAI hosted models." }, - "mistral_format": { + "azure_foundry_resource": { "type": "string", - "enum": [ - "ollama", - "openai" - ], - "description": "If using mistral provider, select the upstream message format." + "description": "Resource name for Azure Foundry hosted models." }, - "embeddings_dimensions": { - "type": "integer", - "description": "If using embeddings models, set the number of dimensions to generate." + "cohere": { + "type": "object", + "properties": { + "api_version": { + "type": "string", + "enum": [ + "v1", + "v2" + ], + "description": "Cohere API version for chat route type: v1 (legacy, /v1/chat) or v2 (default, /v2/chat, supports tools).", + "default": "v2" + }, + "embedding_input_type": { + "type": "string", + "enum": [ + "classification", + "clustering", + "image", + "search_document", + "search_query" + ], + "description": "The purpose of the input text to calculate embedding vectors.", + "default": "classification" + }, + "wait_for_model": { + "type": "boolean", + "description": "Wait for the model if it is not ready" + } + } }, - "input_cost": { + "cache_read_cost": { "type": "number", - "description": "Defines the cost per 1M tokens in your prompt." + "description": "Defines the cost per 1M cache-read (cached) prompt tokens." }, - "output_cost_list": { + "cache_write_cost": { + "type": "number", + "description": "Defines the cost per 1M cache-write prompt tokens." + }, + "cache_read_cost_list": { "type": "array", "items": { "type": "object", @@ -422,7 +353,7 @@ "modal" ] }, - "description": "Per-modality override of `output_cost`, in cost per 1M output tokens. Set it for models that price each modality separately." + "description": "Per-modality override of `cache_read_cost`, in cost per 1M cache-read prompt tokens. Set it for models that price each modality separately." }, "service_tier_factor": { "type": "array", @@ -445,11 +376,18 @@ }, "description": "Multiplier applied to the whole request for a service tier. No need to configure a standard/default tier, as the default factor is 1.0 if none of the tier is matched." }, - "top_k": { + "azure_api_version": { + "type": "string", + "description": "'api-version' for Azure OpenAI instances.", + "default": "2023-05-15" + }, + "upstream_url": { + "type": "string", + "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." + }, + "max_tokens": { "type": "integer", - "maximum": 500, - "minimum": 0, - "description": "Defines the top-k most likely tokens, if supported." + "description": "Defines the max_tokens, if using chat or completion models." }, "azure_service": { "type": "string", @@ -460,94 +398,17 @@ "description": "Service type for Azure provider models.", "default": "azure-openai" }, - "dashscope": { - "type": "object", - "properties": { - "international": { - "type": "boolean", - "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", - "default": true - } - } - }, - "bedrock": { - "type": "object", - "properties": { - "batch_bucket_prefix": { - "type": "string", - "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." - }, - "batch_role_arn": { - "type": "string", - "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." - }, - "aws_role_session_name": { - "type": "string", - "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." - }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." - }, - "video_output_s3_uri": { - "type": "string", - "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." - }, - "aws_region": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." - }, - "aws_assume_role_arn": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." - }, - "aws_sts_endpoint_url": { - "type": "string", - "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." - }, - "embeddings_normalize": { - "type": "boolean", - "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", - "default": false - } - } + "azure_foundry_domain": { + "type": "string", + "description": "Domain for Azure Foundry hosted models.", + "default": "services.ai.azure.com" }, "huggingface": { "type": "object", "properties": { - "wait_for_model": { - "type": "boolean", - "description": "Wait for the model if it is not ready" - }, - "use_cache": { - "type": "boolean", - "description": "Use the cache layer on the inference API" - } - } - }, - "cohere": { - "type": "object", - "properties": { - "api_version": { - "type": "string", - "enum": [ - "v1", - "v2" - ], - "description": "Cohere API version for chat route type: v1 (legacy, /v1/chat) or v2 (default, /v2/chat, supports tools).", - "default": "v2" - }, - "embedding_input_type": { - "type": "string", - "enum": [ - "classification", - "clustering", - "image", - "search_document", - "search_query" - ], - "description": "The purpose of the input text to calculate embedding vectors.", - "default": "classification" + "use_cache": { + "type": "boolean", + "description": "Use the cache layer on the inference API" }, "wait_for_model": { "type": "boolean", @@ -555,27 +416,40 @@ } } }, - "kimi": { + "dashscope": { "type": "object", "properties": { "international": { "type": "boolean", - "description": "Two Kimi/Moonshot AI endpoints are available: `api.moonshot.cn` (mainland China) and\n`api.moonshot.ai` (international, default). Set this to `false` to use the mainland China endpoint.\n", + "description": "Two Dashscope endpoints are available, and the international endpoint will be used when this is set to `true`.\nIt is recommended to set this to `true` when using international version of dashscope.\n", "default": true } } }, - "azure_foundry_resource": { - "type": "string", - "description": "Resource name for Azure Foundry hosted models." - }, - "sagemaker": { + "gemini": { "type": "object", "properties": { - "aws_assume_role_arn": { + "endpoint_id": { "type": "string", - "description": "Assume a different IAM role after authentication." + "description": "If running Gemini on Vertex Model Garden, specify the endpoint ID." + }, + "api_endpoint": { + "type": "string", + "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." + }, + "project_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the project ID." }, + "location_id": { + "type": "string", + "description": "If running Gemini on Vertex, specify the location ID." + } + } + }, + "sagemaker": { + "type": "object", + "properties": { "aws_role_session_name": { "type": "string", "description": "Identifier for the assumed role session." @@ -599,30 +473,79 @@ "aws_region": { "type": "string", "description": "Override the `AWS_REGION` environment variable for SageMaker requests." + }, + "aws_assume_role_arn": { + "type": "string", + "description": "Assume a different IAM role after authentication." } } }, - "upstream_url": { + "temperature": { + "type": "number", + "maximum": 5, + "minimum": 0, + "description": "Defines the matching temperature, if using chat or completion models." + }, + "anthropic_version": { "type": "string", - "description": "Manually specify or override the full URL to the AI operation endpoints, when calling (self-)hosted models, or for running via a private endpoint. Variable substitution is supported. Warning: if variable substitution is used, please verify that the client is from a trusted source to prevent injection." + "description": "Defines the schema/API version, if using Anthropic provider." }, - "output_cost": { - "type": "number", - "description": "Defines the cost per 1M tokens in the output of the AI." + "llama2_format": { + "type": "string", + "enum": [ + "ollama", + "openai", + "raw" + ], + "description": "If using llama2 provider, select the upstream message format." + }, + "databricks": { + "type": "object", + "properties": { + "workspace_instance_id": { + "type": "string", + "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." + } + } + }, + "input_cost_list": { + "type": "array", + "items": { + "type": "object", + "properties": { + "modal": { + "type": "string", + "enum": [ + "audio", + "image", + "text", + "video" + ] + }, + "cost": { + "type": "number" + } + }, + "required": [ + "cost", + "modal" + ] + }, + "description": "Per-modality override of `input_cost`, in cost per 1M prompt tokens. Set it for models that price each modality separately." }, "context_window_factor": { "type": "array", "items": { "type": "object", "properties": { + "above": { + "type": "string" + }, "input_factor": { "type": "number" }, "output_factor": { "type": "number" - }, - "above": { - "type": "string" } }, "required": [ @@ -633,23 +556,107 @@ }, "description": "Above an input-token threshold, scale input/output pricing with the corresponding factor." }, - "temperature": { - "type": "number", - "maximum": 5, + "top_k": { + "type": "integer", + "maximum": 500, "minimum": 0, - "description": "Defines the matching temperature, if using chat or completion models." + "description": "Defines the top-k most likely tokens, if supported." }, - "anthropic_version": { - "type": "string", - "description": "Defines the schema/API version, if using Anthropic provider." + "bedrock": { + "type": "object", + "properties": { + "video_output_s3_uri": { + "type": "string", + "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." + }, + "batch_bucket_prefix": { + "type": "string", + "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." + }, + "batch_role_arn": { + "type": "string", + "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." + }, + "aws_assume_role_arn": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + }, + "aws_role_session_name": { + "type": "string", + "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + }, + "aws_sts_endpoint_url": { + "type": "string", + "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." + }, + "performance_config_latency": { + "type": "string", + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." + }, + "aws_region": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." + }, + "embeddings_normalize": { + "type": "boolean", + "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", + "default": false + } + } }, - "azure_api_version": { - "type": "string", - "description": "'api-version' for Azure OpenAI instances.", - "default": "2023-05-15" + "output_cost_list": { + "type": "array", + "items": { + "type": "object", + "properties": { + "modal": { + "type": "string", + "enum": [ + "audio", + "image", + "text", + "video" + ] + }, + "cost": { + "type": "number" + } + }, + "required": [ + "cost", + "modal" + ] + }, + "description": "Per-modality override of `output_cost`, in cost per 1M output tokens. Set it for models that price each modality separately." } }, "description": "Key/value settings for the model" + }, + "provider": { + "type": "string", + "enum": [ + "anthropic", + "azure", + "bedrock", + "cerebras", + "cohere", + "dashscope", + "databricks", + "deepseek", + "gemini", + "huggingface", + "kimi", + "llama2", + "mistral", + "ollama", + "openai", + "sagemaker", + "typesafe", + "vercel", + "vllm", + "xai" + ], + "description": "AI provider request format - Kong translates requests to and from the specified backend compatible formats." } }, "required": [ @@ -697,6 +704,28 @@ "description": "For internal use only. ", "nullable": true, "x-speakeasy-type-override": "any" + }, + "route_type": { + "type": "string", + "enum": [ + "audio/v1/audio/speech", + "audio/v1/audio/transcriptions", + "audio/v1/audio/translations", + "image/v1/images/edits", + "image/v1/images/generations", + "llm/v1/assistants", + "llm/v1/batches", + "llm/v1/chat", + "llm/v1/completions", + "llm/v1/embeddings", + "llm/v1/files", + "llm/v1/responses", + "llm/v1/skills", + "passthrough", + "realtime/v1/realtime", + "video/v1/videos/generations" + ], + "description": "The model's operation implementation, for this provider. " } }, "required": [ @@ -716,16 +745,6 @@ "type": "boolean", "description": "Set true to read specific response format from the LLM, and accordingly set the status code / body / headers that proxy back to the client. You need to engineer your LLM prompt to return the correct format, see policy docs 'Overview' page for usage instructions.", "default": false - }, - "http_timeout": { - "type": "integer", - "description": "Timeout in milliseconds for the AI upstream service.", - "default": 60000 - }, - "https_verify": { - "type": "boolean", - "description": "Verify the TLS certificate of the AI upstream service.", - "default": true } }, "required": [ @@ -733,25 +752,6 @@ "prompt" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "consumer_group": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/AiSanitizer.json b/app/_schemas/ai-gateway/policies/AiSanitizer.json index 6f186a61e1a..0ef10ebf613 100644 --- a/app/_schemas/ai-gateway/policies/AiSanitizer.json +++ b/app/_schemas/ai-gateway/policies/AiSanitizer.json @@ -1,51 +1,42 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "skip_logging_sanitized_items": { - "type": "boolean", - "description": "Whether to log sanitized items in the Kong log policies. Turn it on if you want to hide sensitive data from logs.", - "default": false - }, - "port": { - "type": "number", - "description": "The port of the sanitizer", - "default": 8080 - }, - "timeout": { - "type": "number", - "description": "Connection timeout with the sanitizer service.", - "default": 10000 - }, - "stop_on_error": { - "type": "boolean", - "description": "Stop processing if an error occurs.", - "default": true + "redact_type": { + "type": "string", + "enum": [ + "placeholder", + "synthetic" + ], + "description": "What value to be used to redacted to", + "default": "placeholder" }, - "block_if_detected": { - "type": "boolean", - "description": "Whether to block requests containing PII data", - "default": false + "custom_patterns": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "regex": { + "type": "string" + }, + "score": { + "type": "number", + "maximum": 1, + "minimum": 0, + "default": 0.5 + } + }, + "required": [ + "name", + "regex" + ] + }, + "minLength": 1, + "description": "List of custom patterns to be used for anonymization" }, "rejection_mode": { "type": "string", @@ -57,6 +48,16 @@ "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", "default": "none" }, + "sanitization_mode": { + "type": "string", + "enum": [ + "BOTH", + "INPUT", + "OUTPUT" + ], + "description": "The sanitization mode to use for the request", + "default": "INPUT" + }, "anonymize": { "type": "array", "items": { @@ -89,55 +90,14 @@ "all_and_credentials" ] }, - "custom_patterns": { - "type": "array", - "items": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "regex": { - "type": "string" - }, - "score": { - "type": "number", - "maximum": 1, - "minimum": 0, - "default": 0.5 - } - }, - "required": [ - "name", - "regex" - ] - }, - "minLength": 1, - "description": "List of custom patterns to be used for anonymization" + "recover_redacted": { + "type": "boolean", + "description": "Whether to recover redacted data. This doesn't apply to the redacted output.", + "default": true }, "proxy_config": { "type": "object", "properties": { - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, "https_proxy_host": { "type": "string", "description": "A string representing a host name, such as example.com." @@ -160,69 +120,99 @@ "type": "string", "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." } } }, - "continue_on_detection": { + "allow_all_conversation_history": { "type": "boolean", - "description": "If true, the guardrail will not block the request or response. Sanitization data and details will still be visible via kong logs. You can expect this field to work coherently with `sanitization_mode` parameter.", - "default": false + "description": "If false, will ignore all previous chat messages from the conversation history.", + "default": true + }, + "port": { + "type": "number", + "description": "The port of the sanitizer", + "default": 8080 }, "scheme": { "type": "string", "description": "The protocol can be http and https", "default": "http" }, + "timeout": { + "type": "number", + "description": "Connection timeout with the sanitizer service.", + "default": 10000 + }, "keepalive_timeout": { "type": "number", "description": "The keepalive timeout for the established http connnection", "default": 60000 }, - "sanitization_mode": { - "type": "string", - "enum": [ - "BOTH", - "INPUT", - "OUTPUT" - ], - "description": "The sanitization mode to use for the request", - "default": "INPUT" - }, - "recover_redacted": { + "stop_on_error": { "type": "boolean", - "description": "Whether to recover redacted data. This doesn't apply to the redacted output.", + "description": "Stop processing if an error occurs.", "default": true }, - "allow_all_conversation_history": { + "skip_logging_sanitized_items": { "type": "boolean", - "description": "If false, will ignore all previous chat messages from the conversation history.", - "default": true + "description": "Whether to log sanitized items in the Kong log policies. Turn it on if you want to hide sensitive data from logs.", + "default": false }, "host": { "type": "string", "description": "The host of the sanitizer", "default": "localhost" }, - "redact_type": { - "type": "string", - "enum": [ - "placeholder", - "synthetic" - ], - "description": "What value to be used to redacted to", - "default": "placeholder" + "block_if_detected": { + "type": "boolean", + "description": "Whether to block requests containing PII data", + "default": false + }, + "continue_on_detection": { + "type": "boolean", + "description": "If true, the guardrail will not block the request or response. Sanitization data and details will still be visible via kong logs.", + "default": false } } }, - "service": { - "type": "object", - "properties": { - "id": { - "type": "string" - } + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] }, - "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] }, "consumer": { "type": "object", @@ -253,6 +243,16 @@ }, "additionalProperties": false, "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + }, + "service": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "additionalProperties": false, + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/AiSemanticCache.json b/app/_schemas/ai-gateway/policies/AiSemanticCache.json index 9975be9ce97..1029aa86468 100644 --- a/app/_schemas/ai-gateway/policies/AiSemanticCache.json +++ b/app/_schemas/ai-gateway/policies/AiSemanticCache.json @@ -1,30 +1,409 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "ignore_system_prompts": { + "vectordb": { + "type": "object", + "properties": { + "dimensions": { + "type": "integer", + "description": "the desired dimensionality for the vectors" + }, + "threshold": { + "type": "number", + "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." + }, + "distance_metric": { + "type": "string", + "enum": [ + "cosine", + "euclidean" + ], + "description": "the distance metric to use for vector searches" + }, + "redis": { + "type": "object", + "properties": { + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "cloud_authentication": { + "type": "object", + "properties": { + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-encrypted": true, + "x-referenceable": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "auth_provider": { + "type": "string", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + } + }, + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + }, + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + } + } + }, + "pgvector": { + "type": "object", + "properties": { + "user": { + "type": "string", + "description": "the user of the pgvector database", + "default": "postgres", + "x-referenceable": true + }, + "database": { + "type": "string", + "description": "the database of the pgvector database", + "default": "kong-pgvector" + }, + "ssl": { + "type": "boolean", + "description": "whether to use ssl for the pgvector database", + "default": false + }, + "ssl_verify": { + "type": "boolean", + "description": "whether to verify ssl for the pgvector database", + "default": true + }, + "ssl_version": { + "type": "string", + "enum": [ + "any", + "tlsv1_2", + "tlsv1_3" + ], + "description": "the ssl version to use for the pgvector database", + "default": "tlsv1_2" + }, + "ssl_cert_key": { + "type": "string", + "description": "the path of ssl cert key to use for the pgvector database" + }, + "port": { + "type": "integer", + "description": "the port of the pgvector database", + "default": 5432 + }, + "password": { + "type": "string", + "description": "the password of the pgvector database", + "x-referenceable": true, + "x-encrypted": true + }, + "timeout": { + "type": "number", + "description": "the timeout of the pgvector database", + "default": 5000 + }, + "ssl_required": { + "type": "boolean", + "description": "whether ssl is required for the pgvector database", + "default": false + }, + "ssl_cert": { + "type": "string", + "description": "the path of ssl cert to use for the pgvector database" + }, + "host": { + "type": "string", + "description": "the host of the pgvector database", + "default": "127.0.0.1" + } + } + }, + "strategy": { + "type": "string", + "enum": [ + "pgvector", + "redis" + ], + "description": "which vector database driver to use" + } + }, + "required": [ + "dimensions", + "distance_metric", + "strategy" + ] + }, + "proxy_config": { + "type": "object", + "properties": { + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" + } + } + }, + "ignore_assistant_prompts": { "type": "boolean", - "description": "Ignore and discard any system prompts when Vectorizing the request", + "description": "Ignore and discard any assistant prompts when Vectorizing the request", + "default": false + }, + "ignore_tool_prompts": { + "type": "boolean", + "description": "Ignore and discard any tool prompts when Vectorizing the request", "default": false }, "stop_on_failure": { @@ -32,11 +411,6 @@ "description": "Halt the LLM request process in case of a caching system failure", "default": false }, - "cache_ttl": { - "type": "integer", - "description": "TTL in seconds of cache entities. Must be a value greater than 0.", - "default": 300 - }, "cache_control": { "type": "boolean", "description": "When enabled, respect the Cache-Control behaviors defined in RFC7234.", @@ -62,21 +436,6 @@ "model": { "type": "object", "properties": { - "provider": { - "type": "string", - "enum": [ - "azure", - "bedrock", - "databricks", - "gemini", - "huggingface", - "mistral", - "ollama", - "openai", - "vercel" - ], - "description": "AI provider format to use for embeddings API" - }, "name": { "type": "string", "description": "Model name to execute." @@ -84,12 +443,34 @@ "options": { "type": "object", "properties": { + "upstream_url": { + "type": "string", + "description": "upstream url for the embeddings" + }, + "azure": { + "type": "object", + "properties": { + "deployment_id": { + "type": "string", + "description": "Deployment ID for Azure OpenAI instances." + }, + "instance": { + "type": "string", + "description": "Instance name for Azure OpenAI hosted models." + }, + "api_version": { + "type": "string", + "description": "'api-version' for Azure OpenAI instances.", + "default": "2023-05-15" + } + } + }, "bedrock": { "type": "object", "properties": { - "aws_assume_role_arn": { + "aws_region": { "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." }, "aws_role_session_name": { "type": "string", @@ -99,30 +480,30 @@ "type": "string", "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." }, - "embeddings_normalize": { - "type": "boolean", - "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", - "default": false + "performance_config_latency": { + "type": "string", + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." }, "video_output_s3_uri": { "type": "string", "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." }, - "batch_role_arn": { + "batch_bucket_prefix": { "type": "string", - "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." + "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." }, - "aws_region": { + "aws_assume_role_arn": { "type": "string", - "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." + "embeddings_normalize": { + "type": "boolean", + "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", + "default": false }, - "batch_bucket_prefix": { + "batch_role_arn": { "type": "string", - "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." + "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." } } }, @@ -158,577 +539,177 @@ }, "databricks": { "type": "object", - "properties": { - "workspace_instance_id": { - "type": "string", - "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." - } - } - }, - "upstream_url": { - "type": "string", - "description": "upstream url for the embeddings" - }, - "azure": { - "type": "object", - "properties": { - "instance": { - "type": "string", - "description": "Instance name for Azure OpenAI hosted models." - }, - "api_version": { - "type": "string", - "description": "'api-version' for Azure OpenAI instances.", - "default": "2023-05-15" - }, - "deployment_id": { - "type": "string", - "description": "Deployment ID for Azure OpenAI instances." - } - } - } - }, - "description": "Key/value settings for the model" - } - }, - "required": [ - "name", - "provider" - ] - }, - "auth": { - "type": "object", - "properties": { - "gcp_workload_identity_federation_auth_json": { - "type": "string", - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_use_managed_identity": { - "type": "boolean", - "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", - "default": false - }, - "gcp_metadata_url": { - "type": "string", - "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", - "x-referenceable": true - }, - "aws_session_token": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", - "x-referenceable": true, - "x-encrypted": true - }, - "header_name": { - "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", - "x-referenceable": true - }, - "header_value": { - "type": "string", - "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", - "x-referenceable": true, - "x-encrypted": true - }, - "param_value": { - "type": "string", - "description": "Specify the full parameter value for 'param_name'.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", - "x-referenceable": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", - "x-encrypted": true, - "x-referenceable": true - }, - "aws_access_key_id": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "param_name": { - "type": "string", - "description": "If AI model requires authentication via query parameter, specify its name here.", - "x-referenceable": true - }, - "param_location": { - "type": "string", - "enum": [ - "body", - "query" - ], - "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." - }, - "azure_client_secret": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_tenant_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", - "x-referenceable": true - }, - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false - }, - "gcp_oauth_token_url": { - "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", - "x-referenceable": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "allow_override": { - "type": "boolean", - "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", - "default": false + "properties": { + "workspace_instance_id": { + "type": "string", + "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." + } + } + } + }, + "description": "Key/value settings for the model" }, - "gcp_workload_identity_federation_source": { + "provider": { "type": "string", "enum": [ - "aws_iam", - "off" + "azure", + "bedrock", + "databricks", + "gemini", + "huggingface", + "mistral", + "ollama", + "openai", + "vercel" ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." + "description": "AI provider format to use for embeddings API" } - } - } - }, - "required": [ - "model" - ] - }, - "vectordb": { - "type": "object", - "properties": { - "redis": { + }, + "required": [ + "name", + "provider" + ] + }, + "auth": { "type": "object", "properties": { - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "password": { + "azure_client_secret": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", "x-referenceable": true, "x-encrypted": true }, - "sentinel_password": { + "aws_session_token": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", "x-referenceable": true, "x-encrypted": true }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "ssl": { + "allow_override": { "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", + "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", "default": false }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_role": { + "gcp_workload_identity_federation_auth_json": { "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "sentinel_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "cloud_authentication": { - "type": "object", - "properties": { - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_assume_role_arn": { - "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_secret": { - "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_role_session_name": { - "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-referenceable": true, - "x-encrypted": true - } - }, - "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", + "x-referenceable": true, + "x-encrypted": true }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false + "header_value": { + "type": "string", + "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", + "x-referenceable": true, + "x-encrypted": true }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "param_value": { + "type": "string", + "description": "Specify the full parameter value for 'param_name'.", + "x-referenceable": true, + "x-encrypted": true }, - "sentinel_username": { + "azure_client_id": { "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", "x-referenceable": true - } - } - }, - "pgvector": { - "type": "object", - "properties": { - "ssl": { + }, + "azure_tenant_id": { + "type": "string", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_use_service_account": { "type": "boolean", - "description": "whether to use ssl for the pgvector database", + "description": "Use service account auth for GCP-based providers and models.", "default": false }, - "ssl_version": { + "gcp_service_account_json": { "type": "string", - "enum": [ - "any", - "tlsv1_2", - "tlsv1_3" - ], - "description": "the ssl version to use for the pgvector database", - "default": "tlsv1_2" + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", + "x-referenceable": true, + "x-encrypted": true }, - "ssl_cert": { + "header_name": { "type": "string", - "description": "the path of ssl cert to use for the pgvector database" + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", + "x-referenceable": true }, - "host": { + "param_name": { "type": "string", - "description": "the host of the pgvector database", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "description": "the port of the pgvector database", - "default": 5432 + "description": "If AI model requires authentication via query parameter, specify its name here.", + "x-referenceable": true }, - "ssl_required": { + "azure_use_managed_identity": { "type": "boolean", - "description": "whether ssl is required for the pgvector database", + "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", "default": false }, - "ssl_verify": { - "type": "boolean", - "description": "whether to verify ssl for the pgvector database", - "default": true - }, - "ssl_cert_key": { + "gcp_oauth_token_url": { "type": "string", - "description": "the path of ssl cert key to use for the pgvector database" + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true }, - "user": { + "gcp_metadata_url": { "type": "string", - "description": "the user of the pgvector database", - "default": "postgres", + "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", "x-referenceable": true }, - "password": { + "aws_secret_access_key": { "type": "string", - "description": "the password of the pgvector database", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", "x-referenceable": true, "x-encrypted": true }, - "database": { + "gcp_workload_identity_federation_source": { "type": "string", - "description": "the database of the pgvector database", - "default": "kong-pgvector" + "enum": [ + "aws_iam", + "off" + ], + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." }, - "timeout": { - "type": "number", - "description": "the timeout of the pgvector database", - "default": 5000 + "param_location": { + "type": "string", + "enum": [ + "body", + "query" + ], + "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." } } - }, - "strategy": { - "type": "string", - "enum": [ - "pgvector", - "redis" - ], - "description": "which vector database driver to use" - }, - "dimensions": { - "type": "integer", - "description": "the desired dimensionality for the vectors" - }, - "threshold": { - "type": "number", - "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." - }, - "distance_metric": { - "type": "string", - "enum": [ - "cosine", - "euclidean" - ], - "description": "the distance metric to use for vector searches" } }, "required": [ - "dimensions", - "distance_metric", - "strategy" + "model" ] }, - "ignore_assistant_prompts": { - "type": "boolean", - "description": "Ignore and discard any assistant prompts when Vectorizing the request", - "default": false + "message_countback": { + "type": "number", + "maximum": 1000, + "minimum": 1, + "description": "Number of messages in the chat history to Vectorize/Cache", + "default": 1 }, - "ignore_tool_prompts": { + "ignore_system_prompts": { "type": "boolean", - "description": "Ignore and discard any tool prompts when Vectorizing the request", + "description": "Ignore and discard any system prompts when Vectorizing the request", "default": false }, + "cache_ttl": { + "type": "integer", + "description": "TTL in seconds of cache entities. Must be a value greater than 0.", + "default": 300 + }, "exact_caching": { "type": "boolean", "description": "When enabled, a first check for exact query will be done. It will impact DB size", "default": false - }, - "proxy_config": { - "type": "object", - "properties": { - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "proxy_scheme": { - "type": "string", - "enum": [ - "http" - ], - "description": "The proxy scheme to use when connecting. Only `http` is supported.", - "default": "http" - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - } - } - }, - "message_countback": { - "type": "number", - "maximum": 1000, - "minimum": 1, - "description": "Number of messages in the chat history to Vectorize/Cache", - "default": 1 } }, "required": [ @@ -736,7 +717,26 @@ "vectordb" ] }, - "route": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "consumer_group": { "type": "object", "properties": { "id": { @@ -744,9 +744,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -754,9 +754,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -764,9 +764,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -774,7 +774,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiSemanticPromptGuard.json b/app/_schemas/ai-gateway/policies/AiSemanticPromptGuard.json index a67d34fb6bb..80c17acff1c 100644 --- a/app/_schemas/ai-gateway/policies/AiSemanticPromptGuard.json +++ b/app/_schemas/ai-gateway/policies/AiSemanticPromptGuard.json @@ -22,6 +22,99 @@ "config": { "type": "object", "properties": { + "proxy_config": { + "type": "object", + "properties": { + "https_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "proxy_scheme": { + "type": "string", + "enum": [ + "http" + ], + "description": "The proxy scheme to use when connecting. Only `http` is supported.", + "default": "http" + }, + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, + "auth_password": { + "type": "string", + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", + "x-encrypted": true, + "x-referenceable": true + }, + "no_proxy": { + "type": "string", + "description": "Comma-separated list of hosts that should not be proxied." + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + } + } + }, + "search": { + "type": "object", + "properties": { + "threshold": { + "type": "number", + "description": "Threshold for the similarity score to be considered a match.", + "default": 0.5 + } + } + }, + "rules": { + "type": "object", + "properties": { + "match_all_roles": { + "type": "boolean", + "description": "If true, will match all roles in addition to 'user' role in conversation history.", + "default": false + }, + "match_all_conversation_history": { + "type": "boolean", + "description": "If false, will ignore all previous chat prompts from the conversation history.", + "default": false + }, + "allow_prompts": { + "type": "array", + "items": { + "type": "string", + "maxLength": 500, + "minLength": 1 + }, + "maxLength": 100, + "description": "List of prompts to allow." + }, + "deny_prompts": { + "type": "array", + "items": { + "type": "string", + "maxLength": 500, + "minLength": 1 + }, + "maxLength": 100, + "description": "List of prompts to deny." + } + } + }, "genai_category": { "type": "string", "enum": [ @@ -56,31 +149,30 @@ "auth": { "type": "object", "properties": { - "header_name": { + "param_location": { "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", - "x-referenceable": true + "enum": [ + "body", + "query" + ], + "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." }, "azure_use_managed_identity": { "type": "boolean", "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", "default": false }, - "gcp_oauth_token_url": { - "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", - "x-referenceable": true - }, - "gcp_metadata_url": { + "gcp_service_account_json": { "type": "string", - "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", + "x-encrypted": true, "x-referenceable": true }, "aws_access_key_id": { "type": "string", "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "aws_secret_access_key": { "type": "string", @@ -88,32 +180,30 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_session_token": { + "gcp_workload_identity_federation_source": { "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "enum": [ + "aws_iam", + "off" + ], + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." + }, + "gcp_workload_identity_federation_auth_json": { + "type": "string", + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", "x-referenceable": true, "x-encrypted": true }, - "allow_override": { - "type": "boolean", - "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", - "default": false - }, - "param_name": { + "header_name": { "type": "string", - "description": "If AI model requires authentication via query parameter, specify its name here.", + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", "x-referenceable": true }, "param_value": { "type": "string", "description": "Specify the full parameter value for 'param_name'.", - "x-encrypted": true, - "x-referenceable": true - }, - "azure_client_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "azure_client_secret": { "type": "string", @@ -121,24 +211,26 @@ "x-referenceable": true, "x-encrypted": true }, + "azure_tenant_id": { + "type": "string", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "x-referenceable": true + }, "gcp_use_service_account": { "type": "boolean", "description": "Use service account auth for GCP-based providers and models.", "default": false }, - "gcp_workload_identity_federation_source": { + "gcp_oauth_token_url": { "type": "string", - "enum": [ - "aws_iam", - "off" - ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true }, - "gcp_workload_identity_federation_auth_json": { + "aws_session_token": { "type": "string", - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", - "x-referenceable": true, - "x-encrypted": true + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "x-encrypted": true, + "x-referenceable": true }, "header_value": { "type": "string", @@ -146,24 +238,25 @@ "x-referenceable": true, "x-encrypted": true }, - "param_location": { + "param_name": { "type": "string", - "enum": [ - "body", - "query" - ], - "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." + "description": "If AI model requires authentication via query parameter, specify its name here.", + "x-referenceable": true }, - "azure_tenant_id": { + "azure_client_id": { "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", "x-referenceable": true }, - "gcp_service_account_json": { + "gcp_metadata_url": { "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", - "x-referenceable": true, - "x-encrypted": true + "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", + "x-referenceable": true + }, + "allow_override": { + "type": "boolean", + "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "default": false } } }, @@ -192,6 +285,37 @@ "options": { "type": "object", "properties": { + "databricks": { + "type": "object", + "properties": { + "workspace_instance_id": { + "type": "string", + "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." + } + } + }, + "upstream_url": { + "type": "string", + "description": "upstream url for the embeddings" + }, + "azure": { + "type": "object", + "properties": { + "api_version": { + "type": "string", + "description": "'api-version' for Azure OpenAI instances.", + "default": "2023-05-15" + }, + "deployment_id": { + "type": "string", + "description": "Deployment ID for Azure OpenAI instances." + }, + "instance": { + "type": "string", + "description": "Instance name for Azure OpenAI hosted models." + } + } + }, "bedrock": { "type": "object", "properties": { @@ -199,15 +323,19 @@ "type": "string", "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." }, - "aws_assume_role_arn": { - "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." - }, "embeddings_normalize": { "type": "boolean", "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", "default": false }, + "performance_config_latency": { + "type": "string", + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." + }, + "video_output_s3_uri": { + "type": "string", + "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." + }, "batch_bucket_prefix": { "type": "string", "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." @@ -216,6 +344,10 @@ "type": "string", "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." }, + "aws_assume_role_arn": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + }, "aws_role_session_name": { "type": "string", "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." @@ -223,14 +355,6 @@ "aws_sts_endpoint_url": { "type": "string", "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." - }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." - }, - "video_output_s3_uri": { - "type": "string", - "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." } } }, @@ -254,44 +378,13 @@ "huggingface": { "type": "object", "properties": { - "use_cache": { - "type": "boolean", - "description": "Use the cache layer on the inference API" - }, "wait_for_model": { "type": "boolean", "description": "Wait for the model if it is not ready" - } - } - }, - "databricks": { - "type": "object", - "properties": { - "workspace_instance_id": { - "type": "string", - "description": "Workspace Instance ID ('dbc-xxx-yyy') for Databricks model serving." - } - } - }, - "upstream_url": { - "type": "string", - "description": "upstream url for the embeddings" - }, - "azure": { - "type": "object", - "properties": { - "instance": { - "type": "string", - "description": "Instance name for Azure OpenAI hosted models." - }, - "api_version": { - "type": "string", - "description": "'api-version' for Azure OpenAI instances.", - "default": "2023-05-15" - }, - "deployment_id": { - "type": "string", - "description": "Deployment ID for Azure OpenAI instances." + }, + "use_cache": { + "type": "boolean", + "description": "Use the cache layer on the inference API" } } } @@ -339,66 +432,29 @@ "redis": { "type": "object", "properties": { - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "connect_timeout": { + "port": { "type": "integer", - "maximum": 2147483646, + "maximum": 65535, "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true }, - "read_timeout": { + "send_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, - "sentinel_username": { + "username": { "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, - "sentinel_password": { + "password": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", "x-referenceable": true, "x-encrypted": true }, @@ -414,27 +470,21 @@ "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", "default": 256 }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true - }, "keepalive_backlog": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, "sentinel_nodes": { "type": "array", "items": { @@ -457,41 +507,96 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, "ssl": { "type": "boolean", "description": "If set to true, uses SSL to connect to Redis.", "default": false }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, "connection_is_proxied": { "type": "boolean", "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", "default": false }, - "username": { + "sentinel_role": { "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", "x-referenceable": true }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, "cloud_authentication": { "type": "object", "properties": { - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, "aws_is_serverless": { "type": "boolean", "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", "default": true }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, "aws_secret_access_key": { "type": "string", "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", @@ -501,12 +606,12 @@ "aws_assume_role_arn": { "type": "string", "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, - "aws_role_session_name": { + "gcp_service_account_json": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", "x-referenceable": true, "x-encrypted": true }, @@ -516,9 +621,9 @@ "x-referenceable": true, "x-encrypted": true }, - "azure_client_secret": { + "azure_tenant_id": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, @@ -542,49 +647,64 @@ "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "gcp_service_account_json": { + "aws_access_key_id": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-encrypted": true, + "x-referenceable": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." } } }, "pgvector": { "type": "object", "properties": { + "user": { + "type": "string", + "description": "the user of the pgvector database", + "default": "postgres", + "x-referenceable": true + }, + "password": { + "type": "string", + "description": "the password of the pgvector database", + "x-referenceable": true, + "x-encrypted": true + }, "database": { "type": "string", "description": "the database of the pgvector database", "default": "kong-pgvector" }, + "timeout": { + "type": "number", + "description": "the timeout of the pgvector database", + "default": 5000 + }, + "ssl_required": { + "type": "boolean", + "description": "whether ssl is required for the pgvector database", + "default": false + }, + "ssl_verify": { + "type": "boolean", + "description": "whether to verify ssl for the pgvector database", + "default": true + }, "ssl_version": { "type": "string", "enum": [ @@ -595,14 +715,6 @@ "description": "the ssl version to use for the pgvector database", "default": "tlsv1_2" }, - "ssl_cert": { - "type": "string", - "description": "the path of ssl cert to use for the pgvector database" - }, - "ssl_cert_key": { - "type": "string", - "description": "the path of ssl cert key to use for the pgvector database" - }, "host": { "type": "string", "description": "the host of the pgvector database", @@ -613,37 +725,18 @@ "description": "the port of the pgvector database", "default": 5432 }, - "user": { - "type": "string", - "description": "the user of the pgvector database", - "default": "postgres", - "x-referenceable": true - }, - "password": { - "type": "string", - "description": "the password of the pgvector database", - "x-referenceable": true, - "x-encrypted": true - }, - "timeout": { - "type": "number", - "description": "the timeout of the pgvector database", - "default": 5000 - }, "ssl": { "type": "boolean", "description": "whether to use ssl for the pgvector database", "default": false }, - "ssl_required": { - "type": "boolean", - "description": "whether ssl is required for the pgvector database", - "default": false + "ssl_cert": { + "type": "string", + "description": "the path of ssl cert to use for the pgvector database" }, - "ssl_verify": { - "type": "boolean", - "description": "whether to verify ssl for the pgvector database", - "default": true + "ssl_cert_key": { + "type": "string", + "description": "the path of ssl cert key to use for the pgvector database" } } } @@ -653,99 +746,6 @@ "distance_metric", "strategy" ] - }, - "proxy_config": { - "type": "object", - "properties": { - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "proxy_scheme": { - "type": "string", - "enum": [ - "http" - ], - "description": "The proxy scheme to use when connecting. Only `http` is supported.", - "default": "http" - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true - }, - "auth_password": { - "type": "string", - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Comma-separated list of hosts that should not be proxied." - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - } - } - }, - "search": { - "type": "object", - "properties": { - "threshold": { - "type": "number", - "description": "Threshold for the similarity score to be considered a match.", - "default": 0.5 - } - } - }, - "rules": { - "type": "object", - "properties": { - "match_all_conversation_history": { - "type": "boolean", - "description": "If false, will ignore all previous chat prompts from the conversation history.", - "default": false - }, - "allow_prompts": { - "type": "array", - "items": { - "type": "string", - "maxLength": 500, - "minLength": 1 - }, - "maxLength": 100, - "description": "List of prompts to allow." - }, - "deny_prompts": { - "type": "array", - "items": { - "type": "string", - "maxLength": 500, - "minLength": 1 - }, - "maxLength": 100, - "description": "List of prompts to deny." - }, - "match_all_roles": { - "type": "boolean", - "description": "If true, will match all roles in addition to 'user' role in conversation history.", - "default": false - } - } } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AiSemanticResponseGuard.json b/app/_schemas/ai-gateway/policies/AiSemanticResponseGuard.json index e2630764028..d4556847107 100644 --- a/app/_schemas/ai-gateway/policies/AiSemanticResponseGuard.json +++ b/app/_schemas/ai-gateway/policies/AiSemanticResponseGuard.json @@ -22,11 +22,6 @@ "config": { "type": "object", "properties": { - "response_buffer_size": { - "type": "number", - "description": "The amount of bytes receiving from upstream to be buffered before checking the response against the configured rules. This only applies to streaming responses. Note that each buffered batch is checked independently, so a meaning that only emerges from the combination of multiple batches may go undetected.", - "default": 100 - }, "proxy_config": { "type": "object", "properties": { @@ -75,6 +70,16 @@ } } }, + "search": { + "type": "object", + "properties": { + "threshold": { + "type": "number", + "description": "Threshold for the similarity score to be considered a match.", + "default": 0.5 + } + } + }, "rules": { "type": "object", "properties": { @@ -105,164 +110,31 @@ } } }, - "genai_category": { + "llm_format": { "type": "string", "enum": [ - "audio/speech", - "audio/transcription", - "image/generation", - "realtime/generation", - "text/embeddings", - "text/generation" + "anthropic", + "bedrock", + "cohere", + "gemini", + "huggingface", + "openai", + "typesafe" ], - "description": "Generative AI category of the request", - "default": "text/generation" + "description": "LLM input and output format and schema to use", + "default": "openai" }, - "rejection_mode": { - "type": "string", - "enum": [ - "none", - "stealth", - "verbose" - ], - "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", - "default": "none" + "response_buffer_size": { + "type": "number", + "description": "The amount of bytes receiving from upstream to be buffered before checking the response against the configured rules. This only applies to streaming responses. Note that each buffered batch is checked independently, so a meaning that only emerges from the combination of multiple batches may go undetected.", + "default": 100 }, "embeddings": { "type": "object", "properties": { - "auth": { - "type": "object", - "properties": { - "aws_secret_access_key": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_session_token": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", - "x-referenceable": true, - "x-encrypted": true - }, - "param_name": { - "type": "string", - "description": "If AI model requires authentication via query parameter, specify its name here.", - "x-referenceable": true - }, - "azure_client_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", - "x-referenceable": true - }, - "gcp_use_service_account": { - "type": "boolean", - "description": "Use service account auth for GCP-based providers and models.", - "default": false - }, - "aws_access_key_id": { - "type": "string", - "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", - "x-referenceable": true, - "x-encrypted": true - }, - "allow_override": { - "type": "boolean", - "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", - "default": false - }, - "gcp_workload_identity_federation_source": { - "type": "string", - "enum": [ - "aws_iam", - "off" - ], - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." - }, - "header_name": { - "type": "string", - "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", - "x-referenceable": true - }, - "param_value": { - "type": "string", - "description": "Specify the full parameter value for 'param_name'.", - "x-referenceable": true, - "x-encrypted": true - }, - "param_location": { - "type": "string", - "enum": [ - "body", - "query" - ], - "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." - }, - "gcp_metadata_url": { - "type": "string", - "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", - "x-referenceable": true - }, - "gcp_workload_identity_federation_auth_json": { - "type": "string", - "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", - "x-referenceable": true, - "x-encrypted": true - }, - "header_value": { - "type": "string", - "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_secret": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", - "x-encrypted": true, - "x-referenceable": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_use_managed_identity": { - "type": "boolean", - "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", - "default": false - }, - "azure_tenant_id": { - "type": "string", - "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", - "x-referenceable": true - }, - "gcp_oauth_token_url": { - "type": "string", - "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", - "x-referenceable": true - } - } - }, "model": { "type": "object", "properties": { - "provider": { - "type": "string", - "enum": [ - "azure", - "bedrock", - "databricks", - "gemini", - "huggingface", - "mistral", - "ollama", - "openai", - "vercel" - ], - "description": "AI provider format to use for embeddings API" - }, "name": { "type": "string", "description": "Model name to execute." @@ -277,10 +149,6 @@ "azure": { "type": "object", "properties": { - "deployment_id": { - "type": "string", - "description": "Deployment ID for Azure OpenAI instances." - }, "instance": { "type": "string", "description": "Instance name for Azure OpenAI hosted models." @@ -289,54 +157,62 @@ "type": "string", "description": "'api-version' for Azure OpenAI instances.", "default": "2023-05-15" + }, + "deployment_id": { + "type": "string", + "description": "Deployment ID for Azure OpenAI instances." } } }, "bedrock": { "type": "object", "properties": { - "aws_region": { + "aws_role_session_name": { "type": "string", - "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." + "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." }, - "aws_assume_role_arn": { + "aws_sts_endpoint_url": { "type": "string", - "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." + "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." }, - "batch_bucket_prefix": { + "performance_config_latency": { "type": "string", - "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." + "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." }, - "aws_role_session_name": { + "video_output_s3_uri": { "type": "string", - "description": "If using AWS providers (Bedrock), set the identifier of the assumed role session." + "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." }, - "aws_sts_endpoint_url": { + "aws_region": { "type": "string", - "description": "If using AWS providers (Bedrock), override the STS endpoint URL when assuming a different role." + "description": "If using AWS providers (Bedrock) you can override the `AWS_REGION` environment variable by setting this option." }, "embeddings_normalize": { "type": "boolean", "description": "If using AWS providers (Bedrock), set to true to normalize the embeddings.", "default": false }, - "performance_config_latency": { - "type": "string", - "description": "Force the client's performance configuration 'latency' for all requests. Leave empty to let the consumer select the performance configuration." - }, - "video_output_s3_uri": { + "batch_bucket_prefix": { "type": "string", - "description": "S3 URI (s3://bucket/prefix) where Bedrock will store generated video files. Required for video generation." + "description": "S3 URI prefix (s3://bucket/prefix/) where Bedrock will get input files from and store results to for native batch API." }, "batch_role_arn": { "type": "string", "description": "AWS role arn used for calling batch API. Try to get the value from request if ommited." + }, + "aws_assume_role_arn": { + "type": "string", + "description": "If using AWS providers (Bedrock) you can assume a different role after authentication with the current IAM context is successful." } } }, "gemini": { "type": "object", "properties": { + "api_endpoint": { + "type": "string", + "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." + }, "project_id": { "type": "string", "description": "If running Gemini on Vertex, specify the project ID." @@ -344,10 +220,6 @@ "location_id": { "type": "string", "description": "If running Gemini on Vertex, specify the location ID." - }, - "api_endpoint": { - "type": "string", - "description": "If running Gemini on Vertex, specify the regional API endpoint (hostname only)." } } }, @@ -375,177 +247,244 @@ } }, "description": "Key/value settings for the model" + }, + "provider": { + "type": "string", + "enum": [ + "azure", + "bedrock", + "databricks", + "gemini", + "huggingface", + "mistral", + "ollama", + "openai", + "vercel" + ], + "description": "AI provider format to use for embeddings API" } }, "required": [ "name", "provider" ] - } - }, - "required": [ - "model" - ] - }, - "vectordb": { - "type": "object", - "properties": { - "strategy": { - "type": "string", - "enum": [ - "pgvector", - "redis" - ], - "description": "which vector database driver to use" }, - "dimensions": { - "type": "integer", - "description": "the desired dimensionality for the vectors" - }, - "threshold": { - "type": "number", - "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." - }, - "distance_metric": { - "type": "string", - "enum": [ - "cosine", - "euclidean" - ], - "description": "the distance metric to use for vector searches" - }, - "redis": { + "auth": { "type": "object", "properties": { - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, + "param_value": { + "type": "string", + "description": "Specify the full parameter value for 'param_name'.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_use_managed_identity": { + "type": "boolean", + "description": "Set true to use the Azure Cloud Managed Identity (or user-assigned identity) to authenticate with Azure-provider models.", + "default": false + }, + "gcp_service_account_json": { + "type": "string", + "description": "Set this field to the full JSON of the GCP service account to authenticate, if required. If null (and gcp_use_service_account is true), Kong will attempt to read from environment variable `GCP_SERVICE_ACCOUNT`.", + "x-encrypted": true, "x-referenceable": true }, - "username": { + "gcp_metadata_url": { "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "description": "Custom metadata URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google metadata endpoint.", "x-referenceable": true }, - "password": { + "aws_access_key_id": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_ACCESS_KEY_ID environment variable for this policy instance.", "x-referenceable": true, "x-encrypted": true }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 + "aws_session_token": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using temporary IAM credentials (for example issued by AWS STS, Vault, or SSO/SAML). It is sent to AWS as the X-Amz-Security-Token header. Setting this will override the AWS_SESSION_TOKEN environment variable for this policy instance. Because temporary credentials are short-lived, reference this from a secrets backend so it is refreshed before it expires.", + "x-referenceable": true, + "x-encrypted": true }, - "connection_is_proxied": { + "gcp_oauth_token_url": { + "type": "string", + "description": "Custom OAuth token URL for GCP authentication. Useful for restricted network environments or custom GCP endpoints. If null, Kong will use the default Google OAuth token endpoint.", + "x-referenceable": true + }, + "header_value": { + "type": "string", + "description": "Specify the full auth header value for 'header_name', for example 'Bearer key' or just 'key'.", + "x-referenceable": true, + "x-encrypted": true + }, + "param_location": { + "type": "string", + "enum": [ + "body", + "query" + ], + "description": "Specify whether the 'param_name' and 'param_value' options go in a query string, or the POST form/JSON body." + }, + "azure_tenant_id": { + "type": "string", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the tenant ID.", + "x-referenceable": true + }, + "gcp_use_service_account": { "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "description": "Use service account auth for GCP-based providers and models.", "default": false }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "aws_secret_access_key": { + "type": "string", + "description": "Set this if you are using an AWS provider (Bedrock) and you are authenticating using static IAM User credentials. Setting this will override the AWS_SECRET_ACCESS_KEY environment variable for this policy instance.", + "x-referenceable": true, + "x-encrypted": true }, - "sentinel_username": { + "allow_override": { + "type": "boolean", + "description": "If enabled, the authorization header or parameter can be overridden in the request by the value configured in the policy.", + "default": false + }, + "gcp_workload_identity_federation_source": { "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true + "enum": [ + "aws_iam", + "off" + ], + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the source identity provider/system." }, - "sentinel_password": { + "gcp_workload_identity_federation_auth_json": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "description": "Set this if you are using an GCP provider (Gemini) and you are authenticating using Workload Identity Federation. This is the JSON string configuration for the federation operation. If unset, Kong will attempt to read the file path from the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, which should subsequently point to a Workfload Identity auth JSON file.", "x-referenceable": true, "x-encrypted": true }, + "header_name": { + "type": "string", + "description": "If AI model requires authentication via Authorization or API key header, specify its name here.", + "x-referenceable": true + }, + "param_name": { + "type": "string", + "description": "If AI model requires authentication via query parameter, specify its name here.", + "x-referenceable": true + }, + "azure_client_id": { + "type": "string", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client ID.", + "x-referenceable": true + }, + "azure_client_secret": { + "type": "string", + "description": "If azure_use_managed_identity is set to true, and you need to use a different user-assigned identity for this LLM instance, set the client secret.", + "x-referenceable": true, + "x-encrypted": true + } + } + } + }, + "required": [ + "model" + ] + }, + "genai_category": { + "type": "string", + "enum": [ + "audio/speech", + "audio/transcription", + "image/generation", + "realtime/generation", + "text/embeddings", + "text/generation" + ], + "description": "Generative AI category of the request", + "default": "text/generation" + }, + "continue_on_detection": { + "type": "boolean", + "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", + "default": false + }, + "rejection_mode": { + "type": "string", + "enum": [ + "none", + "stealth", + "verbose" + ], + "description": "Controls block response format and status code. 'none' returns 400 with plain text block reason, 'stealth' 403 without details and 'verbose' returns 403 with rich JSON details. In streaming mode, the final SSE chunk includes finish_reason='blocked_by_guard' and 'verbose' will include a 'guardrail_result' metadata entry under 'data.choices[0]' in OpenAI format.", + "default": "none" + }, + "vectordb": { + "type": "object", + "properties": { + "threshold": { + "type": "number", + "description": "the default similarity threshold for accepting semantic search results (float). Higher threshold means more results are considered similar." + }, + "distance_metric": { + "type": "string", + "enum": [ + "cosine", + "euclidean" + ], + "description": "the distance metric to use for vector searches" + }, + "redis": { + "type": "object", + "properties": { "database": { "type": "integer", "description": "Database to use for the Redis connection when using the `redis` strategy", "default": 0 }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, "keepalive_backlog": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "host": { + "sentinel_username": { "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_master": { + "sentinel_password": { "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false }, - "server_name": { + "host": { "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", "x-referenceable": true }, "cloud_authentication": { "type": "object", "properties": { - "gcp_service_account_json": { + "aws_role_session_name": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true }, @@ -555,12 +494,6 @@ "x-referenceable": true, "x-encrypted": true }, - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, "auth_provider": { "type": "string", "enum": [ @@ -571,10 +504,16 @@ "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true }, "aws_secret_access_key": { "type": "string", @@ -582,9 +521,15 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "aws_assume_role_arn": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-encrypted": true, + "x-referenceable": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", "x-referenceable": true, "x-encrypted": true }, @@ -594,37 +539,33 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_access_key_id": { + "azure_tenant_id": { "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_assume_role_arn": { + "aws_cache_name": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, "sentinel_nodes": { "type": "array", @@ -648,34 +589,92 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "ssl": { + "ssl_verify": { "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - } - } - }, - "pgvector": { - "type": "object", - "properties": { - "ssl_version": { + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_master": { "type": "string", - "enum": [ - "any", - "tlsv1_2", - "tlsv1_3" - ], - "description": "the ssl version to use for the pgvector database", - "default": "tlsv1_2" + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "ssl_cert": { + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "server_name": { "type": "string", - "description": "the path of ssl cert to use for the pgvector database" + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true }, - "ssl_cert_key": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { "type": "string", - "description": "the path of ssl cert key to use for the pgvector database" + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-encrypted": true, + "x-referenceable": true + } + } + }, + "pgvector": { + "type": "object", + "properties": { "host": { "type": "string", "description": "the host of the pgvector database", @@ -686,12 +685,23 @@ "description": "the port of the pgvector database", "default": 5432 }, + "user": { + "type": "string", + "description": "the user of the pgvector database", + "default": "postgres", + "x-referenceable": true + }, "password": { "type": "string", "description": "the password of the pgvector database", "x-referenceable": true, "x-encrypted": true }, + "timeout": { + "type": "number", + "description": "the timeout of the pgvector database", + "default": 5000 + }, "ssl": { "type": "boolean", "description": "whether to use ssl for the pgvector database", @@ -702,28 +712,47 @@ "description": "whether ssl is required for the pgvector database", "default": false }, - "user": { - "type": "string", - "description": "the user of the pgvector database", - "default": "postgres", - "x-referenceable": true + "ssl_verify": { + "type": "boolean", + "description": "whether to verify ssl for the pgvector database", + "default": true }, "database": { "type": "string", "description": "the database of the pgvector database", "default": "kong-pgvector" }, - "timeout": { - "type": "number", - "description": "the timeout of the pgvector database", - "default": 5000 + "ssl_version": { + "type": "string", + "enum": [ + "any", + "tlsv1_2", + "tlsv1_3" + ], + "description": "the ssl version to use for the pgvector database", + "default": "tlsv1_2" }, - "ssl_verify": { - "type": "boolean", - "description": "whether to verify ssl for the pgvector database", - "default": true + "ssl_cert": { + "type": "string", + "description": "the path of ssl cert to use for the pgvector database" + }, + "ssl_cert_key": { + "type": "string", + "description": "the path of ssl cert key to use for the pgvector database" } } + }, + "strategy": { + "type": "string", + "enum": [ + "pgvector", + "redis" + ], + "description": "which vector database driver to use" + }, + "dimensions": { + "type": "integer", + "description": "the desired dimensionality for the vectors" } }, "required": [ @@ -731,35 +760,6 @@ "distance_metric", "strategy" ] - }, - "search": { - "type": "object", - "properties": { - "threshold": { - "type": "number", - "description": "Threshold for the similarity score to be considered a match.", - "default": 0.5 - } - } - }, - "llm_format": { - "type": "string", - "enum": [ - "anthropic", - "bedrock", - "cohere", - "gemini", - "huggingface", - "openai", - "typesafe" - ], - "description": "LLM input and output format and schema to use", - "default": "openai" - }, - "continue_on_detection": { - "type": "boolean", - "description": "If true, the guardrail will not block the request or response. Block data and details will still be visible via kong logs. You can expect this field to work coherently with `guarding_mode` parameter.", - "default": false } }, "required": [ @@ -767,7 +767,7 @@ "vectordb" ] }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -775,9 +775,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -785,9 +785,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -795,9 +795,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -805,7 +805,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/AppDynamics.json b/app/_schemas/ai-gateway/policies/AppDynamics.json index 97433373e4c..4f3bdacf83d 100644 --- a/app/_schemas/ai-gateway/policies/AppDynamics.json +++ b/app/_schemas/ai-gateway/policies/AppDynamics.json @@ -1,5 +1,9 @@ { "properties": { + "config": { + "type": "object", + "additionalProperties": true + }, "protocols": { "type": "array", "items": { @@ -19,11 +23,7 @@ "https" ] }, - "config": { - "type": "object", - "additionalProperties": true - }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -31,9 +31,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -41,9 +41,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -51,7 +51,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/AwsLambda.json b/app/_schemas/ai-gateway/policies/AwsLambda.json index 722bb135703..1979bd73089 100644 --- a/app/_schemas/ai-gateway/policies/AwsLambda.json +++ b/app/_schemas/ai-gateway/policies/AwsLambda.json @@ -22,31 +22,24 @@ "config": { "type": "object", "properties": { - "aws_role_session_name": { + "aws_assume_role_arn": { "type": "string", - "description": "The identifier of the assumed role session.", - "default": "kong" + "description": "The target AWS IAM role ARN used to invoke the Lambda function.", + "x-encrypted": true, + "x-referenceable": true }, - "qualifier": { + "aws_region": { "type": "string", - "description": "The qualifier to use when invoking the function." + "description": "A string representing a host name, such as example.com." }, - "forward_request_method": { + "forward_request_body": { "type": "boolean", - "description": "An optional value that defines whether the original HTTP request method verb is sent in the request_method field of the JSON-encoded request.", + "description": "An optional value that defines whether the request body is sent in the request_body field of the JSON-encoded request. If the body arguments can be parsed, they are sent in the separate request_body_args field of the request. ", "default": false }, - "aws_sts_endpoint_url": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "function_name": { - "type": "string", - "description": "The AWS Lambda function to invoke. Both function name and function ARN (including partial) are supported." - }, - "forward_request_headers": { + "is_proxy_integration": { "type": "boolean", - "description": "An optional value that defines whether the original HTTP request headers are sent as a map in the request_headers field of the JSON-encoded request.", + "description": "An optional value that defines whether the response format to receive from the Lambda to this format.", "default": false }, "skip_large_bodies": { @@ -63,19 +56,11 @@ "description": "Identifier to select the IMDS protocol version to use: `v1` or `v2`.", "default": "v1" }, - "aws_region": { + "aws_secret": { "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "is_proxy_integration": { - "type": "boolean", - "description": "An optional value that defines whether the response format to receive from the Lambda to this format.", - "default": false - }, - "awsgateway_compatible": { - "type": "boolean", - "description": "An optional value that defines whether the policy should wrap requests into the Amazon API gateway.", - "default": false + "description": "The AWS secret credential to be used when invoking the function. ", + "x-encrypted": true, + "x-referenceable": true }, "empty_arrays_mode": { "type": "string", @@ -91,11 +76,9 @@ "description": "An optional value in milliseconds that defines how long an idle connection lives before being closed.", "default": 60000 }, - "aws_assume_role_arn": { + "aws_sts_endpoint_url": { "type": "string", - "description": "The target AWS IAM role ARN used to invoke the Lambda function.", - "x-referenceable": true, - "x-encrypted": true + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." }, "invocation_type": { "type": "string", @@ -107,20 +90,52 @@ "description": "The InvocationType to use when invoking the function. Available types are RequestResponse, Event, DryRun.", "default": "RequestResponse" }, - "host": { + "aws_role_session_name": { "type": "string", - "description": "A string representing a host name, such as example.com." + "description": "The identifier of the assumed role session.", + "default": "kong" }, - "base64_encode_body": { + "log_type": { + "type": "string", + "enum": [ + "None", + "Tail" + ], + "description": "The LogType to use when invoking the function. By default, None and Tail are supported.", + "default": "Tail" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 443 + }, + "ssl_verify": { "type": "boolean", - "description": "An optional value that Base64-encodes the request body.", + "description": "Set to `true` to verify the TLS certificate when connecting to AWS services.", "default": true }, - "aws_key": { + "proxy_url": { "type": "string", - "description": "The AWS key credential to be used when invoking the function.", - "x-referenceable": true, - "x-encrypted": true + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." + }, + "timeout": { + "type": "number", + "description": "An optional timeout in milliseconds when invoking the function.", + "default": 60000 + }, + "function_name": { + "type": "string", + "description": "The AWS Lambda function to invoke. Both function name and function ARN (including partial) are supported." + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "disable_https": { + "type": "boolean", + "default": false }, "unhandled_status": { "type": "integer", @@ -128,28 +143,25 @@ "minimum": 100, "description": "The response status code to use (instead of the default 200, 202, or 204) in the case of an Unhandled Function Error." }, - "forward_request_body": { + "forward_request_uri": { "type": "boolean", - "description": "An optional value that defines whether the request body is sent in the request_body field of the JSON-encoded request. If the body arguments can be parsed, they are sent in the separate request_body_args field of the request. ", + "description": "An optional value that defines whether the original HTTP request URI is sent in the request_uri field of the JSON-encoded request.", "default": false }, - "aws_secret": { + "forward_request_headers": { + "type": "boolean", + "description": "An optional value that defines whether the original HTTP request headers are sent as a map in the request_headers field of the JSON-encoded request.", + "default": false + }, + "aws_key": { "type": "string", - "description": "The AWS secret credential to be used when invoking the function. ", + "description": "The AWS key credential to be used when invoking the function.", "x-referenceable": true, "x-encrypted": true }, - "log_type": { - "type": "string", - "enum": [ - "None", - "Tail" - ], - "description": "The LogType to use when invoking the function. By default, None and Tail are supported.", - "default": "Tail" - }, - "disable_https": { + "awsgateway_compatible": { "type": "boolean", + "description": "An optional value that defines whether the policy should wrap requests into the Amazon API gateway.", "default": false }, "awsgateway_compatible_payload_version": { @@ -161,31 +173,19 @@ "description": "An optional value that defines which version will be used to generate the AWS API Gateway compatible payload. The default will be `1.0`.", "default": "1.0" }, - "proxy_url": { + "qualifier": { "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 443 - }, - "ssl_verify": { - "type": "boolean", - "description": "Set to `true` to verify the TLS certificate when connecting to AWS services.", - "default": true + "description": "The qualifier to use when invoking the function." }, - "forward_request_uri": { + "forward_request_method": { "type": "boolean", - "description": "An optional value that defines whether the original HTTP request URI is sent in the request_uri field of the JSON-encoded request.", + "description": "An optional value that defines whether the original HTTP request method verb is sent in the request_method field of the JSON-encoded request.", "default": false }, - "timeout": { - "type": "number", - "description": "An optional timeout in milliseconds when invoking the function.", - "default": 60000 + "base64_encode_body": { + "type": "boolean", + "description": "An optional value that Base64-encodes the request body.", + "default": true } } }, diff --git a/app/_schemas/ai-gateway/policies/AzureFunctions.json b/app/_schemas/ai-gateway/policies/AzureFunctions.json index 56c9e968535..406f09df51d 100644 --- a/app/_schemas/ai-gateway/policies/AzureFunctions.json +++ b/app/_schemas/ai-gateway/policies/AzureFunctions.json @@ -1,8 +1,49 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "tcp", + "tls", + "tls_passthrough", + "udp", + "ws", + "wss" + ], + "description": "A string representing a protocol, such as HTTP or HTTPS." + }, + "description": "A set of strings representing protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "timeout": { + "type": "number", + "description": "Timeout in milliseconds before closing a connection to the Azure Functions server.", + "default": 600000 + }, + "keepalive": { + "type": "number", + "description": "Time in milliseconds during which an idle connection to the Azure Functions server lives before being closed.", + "default": 60000 + }, + "https_verify": { + "type": "boolean", + "description": "Set to `true` to authenticate the Azure Functions server.", + "default": true + }, "clientid": { "type": "string", "description": "The `clientid` to access the Azure resources. If provided, it is injected as the `x-functions-clientid` header.", @@ -13,9 +54,16 @@ "type": "string", "description": "The Azure app name." }, - "functionname": { + "https": { + "type": "boolean", + "description": "Use of HTTPS to connect with the Azure Functions server.", + "default": true + }, + "apikey": { "type": "string", - "description": "Name of the Azure function to invoke." + "description": "The apikey to access the Azure resources. If provided, it is injected as the `x-functions-key` header.", + "x-encrypted": true, + "x-referenceable": true }, "hostdomain": { "type": "string", @@ -27,31 +75,9 @@ "description": "Route prefix to use.", "default": "api" }, - "timeout": { - "type": "number", - "description": "Timeout in milliseconds before closing a connection to the Azure Functions server.", - "default": 600000 - }, - "keepalive": { - "type": "number", - "description": "Time in milliseconds during which an idle connection to the Azure Functions server lives before being closed.", - "default": 60000 - }, - "https": { - "type": "boolean", - "description": "Use of HTTPS to connect with the Azure Functions server.", - "default": true - }, - "https_verify": { - "type": "boolean", - "description": "Set to `true` to authenticate the Azure Functions server.", - "default": true - }, - "apikey": { + "functionname": { "type": "string", - "description": "The apikey to access the Azure resources. If provided, it is injected as the `x-functions-key` header.", - "x-referenceable": true, - "x-encrypted": true + "description": "Name of the Azure function to invoke." } }, "required": [ @@ -59,32 +85,6 @@ "functionname" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "tcp", - "tls", - "tls_passthrough", - "udp", - "ws", - "wss" - ], - "description": "A string representing a protocol, such as HTTP or HTTPS." - }, - "description": "A set of strings representing protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/BasicAuth.json b/app/_schemas/ai-gateway/policies/BasicAuth.json index 1836d352940..a73c7a94e84 100644 --- a/app/_schemas/ai-gateway/policies/BasicAuth.json +++ b/app/_schemas/ai-gateway/policies/BasicAuth.json @@ -36,11 +36,6 @@ "config": { "type": "object", "properties": { - "hide_credentials": { - "type": "boolean", - "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service. If `true`, the policy will strip the credential from the request (i.e. the `Authorization` header) before proxying it.", - "default": true - }, "realm": { "type": "string", "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value.", @@ -83,19 +78,6 @@ "redis": { "type": "object", "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "x-referenceable": true - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, "timeout": { "type": "integer", "maximum": 2147483646, @@ -108,21 +90,29 @@ "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, "ssl": { "type": "boolean", "description": "If set to true, uses SSL to connect to Redis.", "default": false }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, "server_name": { "type": "string", "description": "A string representing an SNI (server name indication) value for TLS.", "x-referenceable": true }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, "password": { "type": "string", "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", @@ -132,37 +122,21 @@ "cloud_authentication": { "type": "object", "properties": { - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, "aws_assume_role_arn": { "type": "string", "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, - "gcp_service_account_json": { + "azure_client_id": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_id": { + "azure_client_secret": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, @@ -171,31 +145,27 @@ "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, "aws_access_key_id": { "type": "string", "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, "aws_role_session_name": { "type": "string", "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_secret": { + "gcp_service_account_json": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", "x-referenceable": true, "x-encrypted": true }, @@ -204,14 +174,39 @@ "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true + }, + "auth_provider": { + "type": "string", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "x-referenceable": true } }, "description": "Redis configuration" @@ -221,6 +216,11 @@ "anonymous": { "type": "string", "description": "An optional string (Consumer UUID or username) value to use as an \"anonymous\" consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`. Please note that this value must refer to the Consumer `id` or `username` attribute, and **not** its `custom_id`." + }, + "hide_credentials": { + "type": "boolean", + "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service. If `true`, the policy will strip the credential from the request (i.e. the `Authorization` header) before proxying it.", + "default": true } } }, diff --git a/app/_schemas/ai-gateway/policies/BotDetection.json b/app/_schemas/ai-gateway/policies/BotDetection.json index 192404dadcf..a672499f2a8 100644 --- a/app/_schemas/ai-gateway/policies/BotDetection.json +++ b/app/_schemas/ai-gateway/policies/BotDetection.json @@ -40,7 +40,7 @@ } } }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -48,9 +48,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -58,7 +58,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/Canary.json b/app/_schemas/ai-gateway/policies/Canary.json index 50114e27b6f..2bdc63d93d4 100644 --- a/app/_schemas/ai-gateway/policies/Canary.json +++ b/app/_schemas/ai-gateway/policies/Canary.json @@ -26,42 +26,6 @@ "type": "number", "description": "Future time in seconds since epoch, when the canary release will start. Ignored when `percentage` is set, or when using `allow` or `deny` in `hash`." }, - "duration": { - "type": "number", - "description": "The duration of the canary release in seconds.", - "default": 3600 - }, - "steps": { - "type": "number", - "minimum": 1, - "description": "The number of steps for the canary release.", - "default": 1000 - }, - "percentage": { - "type": "number", - "maximum": 100, - "minimum": 0, - "description": "The percentage of traffic to be routed to the canary release." - }, - "upstream_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "upstream_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "upstream_uri": { - "type": "string", - "minLength": 1, - "description": "The URI of the upstream server to be used for the canary release." - }, - "canary_by_header_name": { - "type": "string", - "description": "A string representing an HTTP header name." - }, "hash": { "type": "string", "enum": [ @@ -75,9 +39,17 @@ "description": "Hash algorithm to be used for canary release.\n\n* `consumer`: The hash will be based on the consumer.\n* `ip`: The hash will be based on the client IP address.\n* `none`: No hash will be applied.\n* `allow`: Allows the specified groups to access the canary release.\n* `deny`: Denies the specified groups from accessing the canary release.\n* `header`: The hash will be based on the specified header value.", "default": "consumer" }, - "hash_header": { - "type": "string", - "description": "A string representing an HTTP header name." + "percentage": { + "type": "number", + "maximum": 100, + "minimum": 0, + "description": "The percentage of traffic to be routed to the canary release." + }, + "upstream_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." }, "upstream_fallback": { "type": "boolean", @@ -90,6 +62,34 @@ "type": "string" }, "description": "The groups allowed to access the canary release." + }, + "hash_header": { + "type": "string", + "description": "A string representing an HTTP header name." + }, + "duration": { + "type": "number", + "description": "The duration of the canary release in seconds.", + "default": 3600 + }, + "steps": { + "type": "number", + "minimum": 1, + "description": "The number of steps for the canary release.", + "default": 1000 + }, + "upstream_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "upstream_uri": { + "type": "string", + "minLength": 1, + "description": "The URI of the upstream server to be used for the canary release." + }, + "canary_by_header_name": { + "type": "string", + "description": "A string representing an HTTP header name." } } }, diff --git a/app/_schemas/ai-gateway/policies/Confluent.json b/app/_schemas/ai-gateway/policies/Confluent.json index 304d371e6ed..7b6b53989d9 100644 --- a/app/_schemas/ai-gateway/policies/Confluent.json +++ b/app/_schemas/ai-gateway/policies/Confluent.json @@ -1,36 +1,18 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "producer_request_timeout": { - "type": "integer", - "description": "Time to wait for a Produce response in milliseconds.", - "default": 2000 + "confluent_cloud_api_secret": { + "type": "string", + "description": "The corresponding secret for the Confluent Cloud API key.", + "x-referenceable": true, + "x-encrypted": true }, - "producer_async_buffering_limits_messages_in_memory": { - "type": "integer", - "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.", - "default": 50000 + "forward_uri": { + "type": "boolean", + "description": "Include the request URI and URI arguments (as in, query arguments) in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", + "default": false }, "bootstrap_servers": { "type": "array", @@ -55,24 +37,47 @@ }, "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." }, - "allowed_topics": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The list of allowed topic names to which messages can be sent. The default topic configured in the `topic` field is always allowed, regardless of its inclusion in `allowed_topics`." + "keepalive": { + "type": "integer", + "description": "Keepalive timeout in milliseconds.", + "default": 60000 }, - "forward_uri": { + "keepalive_enabled": { "type": "boolean", - "description": "Include the request URI and URI arguments (as in, query arguments) in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", "default": false }, + "cluster_api_secret": { + "type": "string", + "description": "Password/ApiSecret for SASL authentication.", + "x-encrypted": true, + "x-referenceable": true + }, + "producer_request_limits_bytes_per_request": { + "type": "integer", + "description": "Maximum size of a Produce request in bytes.", + "default": 1048576 + }, + "producer_async": { + "type": "boolean", + "description": "Flag to enable asynchronous mode.", + "default": true + }, "schema_registry": { "type": "object", "properties": { "confluent": { "type": "object", "properties": { + "url": { + "type": "string", + "description": "The URL of the schema registry." + }, + "ttl": { + "type": "number", + "maximum": 3600, + "minimum": 0, + "description": "The TTL in seconds for the schema registry cache." + }, "ssl_verify": { "type": "boolean", "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.", @@ -81,38 +86,38 @@ "authentication": { "type": "object", "properties": { - "mode": { - "type": "string", - "enum": [ - "basic", - "none", - "oauth2" - ], - "description": "Authentication mode to use with the schema registry.", - "default": "none" - }, - "basic": { + "oauth2": { "type": "object", "properties": { - "username": { + "token_post_args": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra post arguments to be passed in the token endpoint request." + }, + "grant_type": { "type": "string", - "x-encrypted": true, - "x-referenceable": true + "enum": [ + "client_credentials", + "password" + ], + "description": "The OAuth grant type to be used.", + "default": "client_credentials" }, - "password": { + "client_id": { "type": "string", + "description": "The client ID for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true - } - }, - "required": [ - "password", - "username" - ] - }, - "oauth2": { - "type": "object", - "properties": { + }, + "password": { + "type": "string", + "description": "The password to use if `config.oauth.grant_type` is set to `password`.", + "x-encrypted": true, + "x-referenceable": true + }, "scopes": { "type": "array", "items": { @@ -131,6 +136,10 @@ "description": "List of audiences passed to the IdP when obtaining a new token.", "default": [] }, + "token_endpoint": { + "type": "string", + "description": "The token endpoint URI." + }, "token_headers": { "type": "object", "additionalProperties": { @@ -139,26 +148,9 @@ }, "description": "Extra headers to be passed in the token endpoint request." }, - "token_post_args": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra post arguments to be passed in the token endpoint request." - }, - "grant_type": { - "type": "string", - "enum": [ - "client_credentials", - "password" - ], - "description": "The OAuth grant type to be used.", - "default": "client_credentials" - }, - "client_id": { + "client_secret": { "type": "string", - "description": "The client ID for the application registration in the IdP.", + "description": "The client secret for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true }, @@ -167,22 +159,6 @@ "description": "The username to use if `config.oauth.grant_type` is set to `password`.", "x-referenceable": true, "x-encrypted": true - }, - "token_endpoint": { - "type": "string", - "description": "The token endpoint URI." - }, - "client_secret": { - "type": "string", - "description": "The client secret for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true - }, - "password": { - "type": "string", - "description": "The password to use if `config.oauth.grant_type` is set to `password`.", - "x-encrypted": true, - "x-referenceable": true } }, "required": [ @@ -192,6 +168,28 @@ "oauth2_client": { "type": "object", "properties": { + "https_proxy": { + "type": "string", + "description": "The proxy to use when making HTTPS requests to the IdP." + }, + "https_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + }, + "no_proxy": { + "type": "string", + "description": "A comma-separated list of hosts that should not be proxied." + }, + "keep_alive": { + "type": "boolean", + "description": "Whether to use keepalive connections to the IdP.", + "default": true + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", + "default": true + }, "auth_method": { "type": "string", "enum": [ @@ -203,13 +201,13 @@ "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", "default": "client_secret_post" }, - "http_proxy_authorization": { + "http_proxy": { "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." + "description": "The proxy to use when making HTTP requests to the IdP." }, - "https_proxy": { + "http_proxy_authorization": { "type": "string", - "description": "The proxy to use when making HTTPS requests to the IdP." + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." }, "timeout": { "type": "integer", @@ -231,43 +229,50 @@ "type": "number", "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", "default": 1.1 - }, - "http_proxy": { - "type": "string", - "description": "The proxy to use when making HTTP requests to the IdP." - }, - "https_proxy_authorization": { + } + } + }, + "mode": { + "type": "string", + "enum": [ + "basic", + "none", + "oauth2" + ], + "description": "Authentication mode to use with the schema registry.", + "default": "none" + }, + "basic": { + "type": "object", + "properties": { + "username": { "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + "x-referenceable": true, + "x-encrypted": true }, - "no_proxy": { + "password": { "type": "string", - "description": "A comma-separated list of hosts that should not be proxied." - }, - "keep_alive": { - "type": "boolean", - "description": "Whether to use keepalive connections to the IdP.", - "default": true - }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", - "default": true + "x-encrypted": true, + "x-referenceable": true } - } + }, + "required": [ + "password", + "username" + ] } } }, "value_schema": { "type": "object", "properties": { - "subject_name": { - "type": "string", - "description": "The name of the subject" - }, "schema_version": { "type": "string", "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version." + }, + "subject_name": { + "type": "string", + "description": "The name of the subject" } } }, @@ -283,22 +288,34 @@ "description": "The name of the subject" } } - }, - "url": { - "type": "string", - "description": "The URL of the schema registry." - }, - "ttl": { - "type": "number", - "maximum": 3600, - "minimum": 0, - "description": "The TTL in seconds for the schema registry cache." } } } }, "description": "The plugin-global schema registry configuration. This can be overwritten by the topic configuration." }, + "topics_query_arg": { + "type": "string", + "description": "The request query parameter name that contains the topics to publish to" + }, + "cluster_api_key": { + "type": "string", + "description": "Username/Apikey for SASL authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "forward_body": { + "type": "boolean", + "description": "Include the request body in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", + "default": true + }, + "message_by_lua_functions": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The Lua functions that manipulates the message being sent to the Kafka topic." + }, "security": { "type": "object", "properties": { @@ -309,66 +326,28 @@ } } }, - "producer_request_limits_messages_per_request": { - "type": "integer", - "description": "Maximum number of messages to include into a single producer request.", - "default": 200 - }, - "producer_request_limits_bytes_per_request": { - "type": "integer", - "description": "Maximum size of a Produce request in bytes.", - "default": 1048576 - }, - "topics_query_arg": { - "type": "string", - "description": "The request query parameter name that contains the topics to publish to" - }, - "topic": { - "type": "string", - "description": "The default Kafka topic to publish to if the query parameter defined in the `topics_query_arg` does not exist in the request" - }, - "producer_request_retries_max_attempts": { + "producer_request_timeout": { "type": "integer", - "description": "Maximum number of retry attempts per single Produce request.", - "default": 10 - }, - "keepalive_enabled": { - "type": "boolean", - "default": false - }, - "confluent_cloud_api_key": { - "type": "string", - "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.", - "x-referenceable": true, - "x-encrypted": true + "description": "Time to wait for a Produce response in milliseconds.", + "default": 2000 }, - "message_by_lua_functions": { + "allowed_topics": { "type": "array", "items": { "type": "string" }, - "description": "The Lua functions that manipulates the message being sent to the Kafka topic." + "description": "The list of allowed topic names to which messages can be sent. The default topic configured in the `topic` field is always allowed, regardless of its inclusion in `allowed_topics`." }, - "cluster_name": { + "key_query_arg": { "type": "string", - "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." - }, - "producer_async_flush_timeout": { - "type": "integer", - "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.", - "default": 1000 + "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering." }, - "confluent_cloud_api_secret": { + "confluent_cloud_api_key": { "type": "string", - "description": "The corresponding secret for the Confluent Cloud API key.", + "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.", "x-referenceable": true, "x-encrypted": true }, - "forward_method": { - "type": "boolean", - "description": "Include the request method in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", - "default": false - }, "producer_request_acks": { "type": "integer", "enum": [ @@ -379,51 +358,53 @@ "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).", "default": 1 }, - "producer_request_retries_backoff_timeout": { - "type": "integer", - "description": "Backoff interval between retry attempts in milliseconds.", - "default": 100 - }, - "key_query_arg": { + "topic": { "type": "string", - "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering." + "description": "The default Kafka topic to publish to if the query parameter defined in the `topics_query_arg` does not exist in the request" + }, + "forward_method": { + "type": "boolean", + "description": "Include the request method in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", + "default": false + }, + "producer_request_limits_messages_per_request": { + "type": "integer", + "description": "Maximum number of messages to include into a single producer request.", + "default": 200 }, "timeout": { "type": "integer", "description": "Socket timeout in milliseconds.", "default": 10000 }, - "cluster_api_key": { - "type": "string", - "description": "Username/Apikey for SASL authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "cluster_api_secret": { - "type": "string", - "description": "Password/ApiSecret for SASL authentication.", - "x-referenceable": true, - "x-encrypted": true - }, "forward_headers": { "type": "boolean", "description": "Include the request headers in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", "default": false }, - "producer_async": { - "type": "boolean", - "description": "Flag to enable asynchronous mode.", - "default": true + "producer_async_buffering_limits_messages_in_memory": { + "type": "integer", + "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.", + "default": 50000 }, - "keepalive": { + "cluster_name": { + "type": "string", + "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." + }, + "producer_async_flush_timeout": { "type": "integer", - "description": "Keepalive timeout in milliseconds.", - "default": 60000 + "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.", + "default": 1000 }, - "forward_body": { - "type": "boolean", - "description": "Include the request body in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", - "default": true + "producer_request_retries_max_attempts": { + "type": "integer", + "description": "Maximum number of retry attempts per single Produce request.", + "default": 10 + }, + "producer_request_retries_backoff_timeout": { + "type": "integer", + "description": "Backoff interval between retry attempts in milliseconds.", + "default": 100 } }, "required": [ @@ -432,6 +413,25 @@ "topic" ] }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/ConfluentConsume.json b/app/_schemas/ai-gateway/policies/ConfluentConsume.json index c0e782a82b9..d9809008367 100644 --- a/app/_schemas/ai-gateway/policies/ConfluentConsume.json +++ b/app/_schemas/ai-gateway/policies/ConfluentConsume.json @@ -1,345 +1,8 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, "config": { "type": "object", "properties": { - "message_deserializer": { - "type": "string", - "enum": [ - "json", - "noop" - ], - "description": "The deserializer to use for the consumed messages.", - "default": "noop" - }, - "commit_strategy": { - "type": "string", - "enum": [ - "auto", - "off" - ], - "description": "The strategy to use for committing offsets.", - "default": "auto" - }, - "enable_dlq": { - "type": "boolean", - "description": "Enables Dead Letter Queue. When enabled, if the message doesn't conform to the schema (from Schema Registry) or there's an error in the `message_by_lua_functions`, it will be forwarded to `dlq_topic` that can be processed later." - }, - "mode": { - "type": "string", - "enum": [ - "http-get", - "server-sent-events", - "websocket" - ], - "description": "The mode of operation for the policy.", - "default": "http-get" - }, - "timeout": { - "type": "integer", - "description": "Socket timeout in milliseconds.", - "default": 10000 - }, - "security": { - "type": "object", - "properties": { - "ssl_verify": { - "type": "boolean", - "description": "Enables verification of the certificate presented by the server.", - "default": true - } - } - }, - "cluster_name": { - "type": "string", - "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." - }, - "cluster_api_key": { - "type": "string", - "description": "Username/Apikey for SASL authentication.", - "x-encrypted": true, - "x-referenceable": true - }, - "cluster_api_secret": { - "type": "string", - "description": "Password/ApiSecret for SASL authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "confluent_cloud_api_key": { - "type": "string", - "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.", - "x-referenceable": true, - "x-encrypted": true - }, - "bootstrap_servers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - } - }, - "required": [ - "host", - "port" - ] - }, - "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." - }, - "topics": { - "type": "array", - "items": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "schema_registry": { - "type": "object", - "properties": { - "confluent": { - "type": "object", - "properties": { - "authentication": { - "type": "object", - "properties": { - "mode": { - "type": "string", - "enum": [ - "basic", - "none", - "oauth2" - ], - "description": "Authentication mode to use with the schema registry.", - "default": "none" - }, - "basic": { - "type": "object", - "properties": { - "username": { - "type": "string", - "x-referenceable": true, - "x-encrypted": true - }, - "password": { - "type": "string", - "x-referenceable": true, - "x-encrypted": true - } - }, - "required": [ - "password", - "username" - ] - }, - "oauth2": { - "type": "object", - "properties": { - "token_post_args": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra post arguments to be passed in the token endpoint request." - }, - "grant_type": { - "type": "string", - "enum": [ - "client_credentials", - "password" - ], - "description": "The OAuth grant type to be used.", - "default": "client_credentials" - }, - "client_id": { - "type": "string", - "description": "The client ID for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true - }, - "password": { - "type": "string", - "description": "The password to use if `config.oauth.grant_type` is set to `password`.", - "x-referenceable": true, - "x-encrypted": true - }, - "scopes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of scopes to request from the IdP when obtaining a new token.", - "default": [ - "openid" - ] - }, - "token_endpoint": { - "type": "string", - "description": "The token endpoint URI." - }, - "client_secret": { - "type": "string", - "description": "The client secret for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true - }, - "username": { - "type": "string", - "description": "The username to use if `config.oauth.grant_type` is set to `password`.", - "x-referenceable": true, - "x-encrypted": true - }, - "audience": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of audiences passed to the IdP when obtaining a new token.", - "default": [] - }, - "token_headers": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra headers to be passed in the token endpoint request." - } - }, - "required": [ - "token_endpoint" - ] - }, - "oauth2_client": { - "type": "object", - "properties": { - "auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none" - ], - "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", - "default": "client_secret_post" - }, - "http_version": { - "type": "number", - "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", - "default": 1.1 - }, - "http_proxy": { - "type": "string", - "description": "The proxy to use when making HTTP requests to the IdP." - }, - "http_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." - }, - "https_proxy": { - "type": "string", - "description": "The proxy to use when making HTTPS requests to the IdP." - }, - "no_proxy": { - "type": "string", - "description": "A comma-separated list of hosts that should not be proxied." - }, - "client_secret_jwt_alg": { - "type": "string", - "enum": [ - "HS256", - "HS512" - ], - "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", - "default": "HS512" - }, - "https_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." - }, - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Network I/O timeout for requests to the IdP in milliseconds.", - "default": 10000 - }, - "keep_alive": { - "type": "boolean", - "description": "Whether to use keepalive connections to the IdP.", - "default": true - }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", - "default": true - } - } - } - } - }, - "url": { - "type": "string", - "description": "The URL of the schema registry." - }, - "ttl": { - "type": "number", - "maximum": 3600, - "minimum": 0, - "description": "The TTL in seconds for the schema registry cache." - }, - "ssl_verify": { - "type": "boolean", - "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.", - "default": true - } - } - } - }, - "description": "The plugin-global schema registry configuration." - } - }, - "required": [ - "name" - ] - }, - "minLength": 1, - "description": "The Kafka topics and their configuration you want to consume from." - }, "schema_registry": { "type": "object", "properties": { @@ -364,6 +27,73 @@ "authentication": { "type": "object", "properties": { + "oauth2_client": { + "type": "object", + "properties": { + "https_proxy": { + "type": "string", + "description": "The proxy to use when making HTTPS requests to the IdP." + }, + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Network I/O timeout for requests to the IdP in milliseconds.", + "default": 10000 + }, + "http_version": { + "type": "number", + "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", + "default": 1.1 + }, + "http_proxy": { + "type": "string", + "description": "The proxy to use when making HTTP requests to the IdP." + }, + "https_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + }, + "no_proxy": { + "type": "string", + "description": "A comma-separated list of hosts that should not be proxied." + }, + "keep_alive": { + "type": "boolean", + "description": "Whether to use keepalive connections to the IdP.", + "default": true + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", + "default": true + }, + "auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none" + ], + "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", + "default": "client_secret_post" + }, + "client_secret_jwt_alg": { + "type": "string", + "enum": [ + "HS256", + "HS512" + ], + "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", + "default": "HS512" + }, + "http_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." + } + } + }, "mode": { "type": "string", "enum": [ @@ -400,14 +130,6 @@ "type": "string", "description": "The token endpoint URI." }, - "token_post_args": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra post arguments to be passed in the token endpoint request." - }, "grant_type": { "type": "string", "enum": [ @@ -417,21 +139,11 @@ "description": "The OAuth grant type to be used.", "default": "client_credentials" }, - "client_id": { + "username": { "type": "string", - "description": "The client ID for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true - }, - "scopes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of scopes to request from the IdP when obtaining a new token.", - "default": [ - "openid" - ] + "description": "The username to use if `config.oauth.grant_type` is set to `password`.", + "x-encrypted": true, + "x-referenceable": true }, "audience": { "type": "array", @@ -449,15 +161,23 @@ }, "description": "Extra headers to be passed in the token endpoint request." }, - "client_secret": { + "token_post_args": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra post arguments to be passed in the token endpoint request." + }, + "client_id": { "type": "string", - "description": "The client secret for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true + "description": "The client ID for the application registration in the IdP.", + "x-encrypted": true, + "x-referenceable": true }, - "username": { + "client_secret": { "type": "string", - "description": "The username to use if `config.oauth.grant_type` is set to `password`.", + "description": "The client secret for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true }, @@ -466,114 +186,359 @@ "description": "The password to use if `config.oauth.grant_type` is set to `password`.", "x-referenceable": true, "x-encrypted": true + }, + "scopes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of scopes to request from the IdP when obtaining a new token.", + "default": [ + "openid" + ] } }, "required": [ "token_endpoint" ] - }, - "oauth2_client": { - "type": "object", - "properties": { - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Network I/O timeout for requests to the IdP in milliseconds.", - "default": 10000 - }, - "http_version": { - "type": "number", - "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", - "default": 1.1 - }, - "http_proxy": { - "type": "string", - "description": "The proxy to use when making HTTP requests to the IdP." - }, - "no_proxy": { - "type": "string", - "description": "A comma-separated list of hosts that should not be proxied." - }, - "keep_alive": { - "type": "boolean", - "description": "Whether to use keepalive connections to the IdP.", - "default": true - }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", - "default": true - }, - "auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none" - ], - "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", - "default": "client_secret_post" - }, - "client_secret_jwt_alg": { - "type": "string", - "enum": [ - "HS256", - "HS512" - ], - "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", - "default": "HS512" - }, - "http_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." - }, - "https_proxy": { - "type": "string", - "description": "The proxy to use when making HTTPS requests to the IdP." - }, - "https_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + } + } + } + } + } + }, + "description": "The plugin-global schema registry configuration." + }, + "message_deserializer": { + "type": "string", + "enum": [ + "json", + "noop" + ], + "description": "The deserializer to use for the consumed messages.", + "default": "noop" + }, + "auto_offset_reset": { + "type": "string", + "enum": [ + "earliest", + "latest" + ], + "description": "The offset to start from when there is no initial offset in the consumer group.", + "default": "earliest" + }, + "enforce_latest_offset_reset": { + "type": "boolean", + "description": "When true, 'latest' offset reset behaves correctly (starts from end). When false (default), maintains backwards compatibility where 'latest' acts like 'earliest'.", + "default": false + }, + "confluent_cloud_api_key": { + "type": "string", + "description": "Apikey for authentication with Confluent Cloud. This allows for management tasks such as creating topics, ACLs, etc.", + "x-referenceable": true, + "x-encrypted": true + }, + "enable_dlq": { + "type": "boolean", + "description": "Enables Dead Letter Queue. When enabled, if the message doesn't conform to the schema (from Schema Registry) or there's an error in the `message_by_lua_functions`, it will be forwarded to `dlq_topic` that can be processed later." + }, + "dlq_topic": { + "type": "string", + "description": "The topic to use for the Dead Letter Queue." + }, + "bootstrap_servers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + } + }, + "required": [ + "host", + "port" + ] + }, + "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." + }, + "topics": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "schema_registry": { + "type": "object", + "properties": { + "confluent": { + "type": "object", + "properties": { + "url": { + "type": "string", + "description": "The URL of the schema registry." + }, + "ttl": { + "type": "number", + "maximum": 3600, + "minimum": 0, + "description": "The TTL in seconds for the schema registry cache." + }, + "ssl_verify": { + "type": "boolean", + "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.", + "default": true + }, + "authentication": { + "type": "object", + "properties": { + "oauth2_client": { + "type": "object", + "properties": { + "https_proxy": { + "type": "string", + "description": "The proxy to use when making HTTPS requests to the IdP." + }, + "keep_alive": { + "type": "boolean", + "description": "Whether to use keepalive connections to the IdP.", + "default": true + }, + "http_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." + }, + "https_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + }, + "no_proxy": { + "type": "string", + "description": "A comma-separated list of hosts that should not be proxied." + }, + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Network I/O timeout for requests to the IdP in milliseconds.", + "default": 10000 + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", + "default": true + }, + "auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none" + ], + "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", + "default": "client_secret_post" + }, + "client_secret_jwt_alg": { + "type": "string", + "enum": [ + "HS256", + "HS512" + ], + "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", + "default": "HS512" + }, + "http_version": { + "type": "number", + "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", + "default": 1.1 + }, + "http_proxy": { + "type": "string", + "description": "The proxy to use when making HTTP requests to the IdP." + } + } + }, + "mode": { + "type": "string", + "enum": [ + "basic", + "none", + "oauth2" + ], + "description": "Authentication mode to use with the schema registry.", + "default": "none" + }, + "basic": { + "type": "object", + "properties": { + "username": { + "type": "string", + "x-referenceable": true, + "x-encrypted": true + }, + "password": { + "type": "string", + "x-referenceable": true, + "x-encrypted": true + } + }, + "required": [ + "password", + "username" + ] + }, + "oauth2": { + "type": "object", + "properties": { + "token_endpoint": { + "type": "string", + "description": "The token endpoint URI." + }, + "token_headers": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra headers to be passed in the token endpoint request." + }, + "grant_type": { + "type": "string", + "enum": [ + "client_credentials", + "password" + ], + "description": "The OAuth grant type to be used.", + "default": "client_credentials" + }, + "username": { + "type": "string", + "description": "The username to use if `config.oauth.grant_type` is set to `password`.", + "x-referenceable": true, + "x-encrypted": true + }, + "password": { + "type": "string", + "description": "The password to use if `config.oauth.grant_type` is set to `password`.", + "x-encrypted": true, + "x-referenceable": true + }, + "token_post_args": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra post arguments to be passed in the token endpoint request." + }, + "client_id": { + "type": "string", + "description": "The client ID for the application registration in the IdP.", + "x-referenceable": true, + "x-encrypted": true + }, + "client_secret": { + "type": "string", + "description": "The client secret for the application registration in the IdP.", + "x-referenceable": true, + "x-encrypted": true + }, + "scopes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of scopes to request from the IdP when obtaining a new token.", + "default": [ + "openid" + ] + }, + "audience": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of audiences passed to the IdP when obtaining a new token.", + "default": [] + } + }, + "required": [ + "token_endpoint" + ] + } } } } } - } + }, + "description": "The plugin-global schema registry configuration." } - } + }, + "required": [ + "name" + ] }, - "description": "The plugin-global schema registry configuration." + "minLength": 1, + "description": "The Kafka topics and their configuration you want to consume from." }, - "auto_offset_reset": { + "mode": { "type": "string", "enum": [ - "earliest", - "latest" + "http-get", + "server-sent-events", + "websocket" ], - "description": "The offset to start from when there is no initial offset in the consumer group.", - "default": "earliest" + "description": "The mode of operation for the policy.", + "default": "http-get" }, "keepalive": { "type": "integer", "description": "Keepalive timeout in milliseconds.", "default": 60000 }, - "enforce_latest_offset_reset": { - "type": "boolean", - "description": "When true, 'latest' offset reset behaves correctly (starts from end). When false (default), maintains backwards compatibility where 'latest' acts like 'earliest'.", - "default": false - }, "keepalive_enabled": { "type": "boolean", "default": false }, - "confluent_cloud_api_secret": { + "cluster_api_key": { "type": "string", - "description": "The corresponding secret for the Confluent Cloud API key.", - "x-encrypted": true, - "x-referenceable": true + "description": "Username/Apikey for SASL authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "security": { + "type": "object", + "properties": { + "ssl_verify": { + "type": "boolean", + "description": "Enables verification of the certificate presented by the server.", + "default": true + } + } + }, + "commit_strategy": { + "type": "string", + "enum": [ + "auto", + "off" + ], + "description": "The strategy to use for committing offsets.", + "default": "auto" + }, + "timeout": { + "type": "integer", + "description": "Socket timeout in milliseconds.", + "default": 10000 }, "message_by_lua_functions": { "type": "array", @@ -582,9 +547,21 @@ }, "description": "The Lua functions that manipulates the message being sent to the client." }, - "dlq_topic": { + "cluster_api_secret": { "type": "string", - "description": "The topic to use for the Dead Letter Queue." + "description": "Password/ApiSecret for SASL authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "confluent_cloud_api_secret": { + "type": "string", + "description": "The corresponding secret for the Confluent Cloud API key.", + "x-referenceable": true, + "x-encrypted": true + }, + "cluster_name": { + "type": "string", + "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." } }, "required": [ @@ -593,6 +570,29 @@ "topics" ] }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/CorrelationId.json b/app/_schemas/ai-gateway/policies/CorrelationId.json index a5c007313f1..5986c608d5c 100644 --- a/app/_schemas/ai-gateway/policies/CorrelationId.json +++ b/app/_schemas/ai-gateway/policies/CorrelationId.json @@ -22,11 +22,6 @@ "config": { "type": "object", "properties": { - "header_name": { - "type": "string", - "description": "The HTTP header name to use for the correlation ID.", - "default": "Kong-Request-ID" - }, "generator": { "type": "string", "enum": [ @@ -41,10 +36,15 @@ "type": "boolean", "description": "Whether to echo the header back to downstream (the client).", "default": false + }, + "header_name": { + "type": "string", + "description": "The HTTP header name to use for the correlation ID.", + "default": "Kong-Request-ID" } } }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -52,9 +52,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -62,9 +62,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -72,7 +72,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/Cors.json b/app/_schemas/ai-gateway/policies/Cors.json index 21441be6008..e5319bedb01 100644 --- a/app/_schemas/ai-gateway/policies/Cors.json +++ b/app/_schemas/ai-gateway/policies/Cors.json @@ -1,28 +1,18 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "minLength": 1, - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { + "private_network": { + "type": "boolean", + "description": "Flag to determine whether the `Access-Control-Allow-Private-Network` header should be sent with `true` as the value.", + "default": false + }, + "preflight_continue": { + "type": "boolean", + "description": "A boolean value that instructs the policy to proxy the `OPTIONS` preflight request to the Upstream service.", + "default": false + }, "origins": { "type": "array", "items": { @@ -30,13 +20,6 @@ }, "description": "List of allowed domains for the `Access-Control-Allow-Origin` header. If you want to allow all origins, add `*` as a single value to this configuration field. The accepted values can either be flat strings or PCRE regexes. NOTE: If you don't specify any allowed domains, all origins are allowed." }, - "headers": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Value for the `Access-Control-Allow-Headers` header." - }, "exposed_headers": { "type": "array", "items": { @@ -77,28 +60,45 @@ "type": "number", "description": "Indicates how long the results of the preflight request can be cached, in `seconds`." }, - "private_network": { + "allow_origin_absent": { "type": "boolean", - "description": "Flag to determine whether the `Access-Control-Allow-Private-Network` header should be sent with `true` as the value.", - "default": false + "description": "A boolean value that skip cors response headers when origin header of request is empty", + "default": true }, - "preflight_continue": { - "type": "boolean", - "description": "A boolean value that instructs the policy to proxy the `OPTIONS` preflight request to the Upstream service.", - "default": false + "headers": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Value for the `Access-Control-Allow-Headers` header." }, "credentials": { "type": "boolean", "description": "Flag to determine whether the `Access-Control-Allow-Credentials` header should be sent with `true` as the value.", "default": false - }, - "allow_origin_absent": { - "type": "boolean", - "description": "A boolean value that skip cors response headers when origin header of request is empty", - "default": true } } }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "minLength": 1, + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/Datadog.json b/app/_schemas/ai-gateway/policies/Datadog.json index 83d2c09e350..3fb7f91f680 100644 --- a/app/_schemas/ai-gateway/policies/Datadog.json +++ b/app/_schemas/ai-gateway/policies/Datadog.json @@ -1,114 +1,33 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "tcp", - "tls", - "tls_passthrough", - "udp", - "ws", - "wss" - ], - "description": "A string representing a protocol, such as HTTP or HTTPS." - }, - "description": "A set of strings representing protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "status_tag": { - "type": "string", - "description": "String to be attached as the tag of the HTTP status.", - "default": "status" - }, - "route_name_tag": { + "consumer_tag": { "type": "string", - "description": "String to be attached as tag of the route name or ID." - }, - "retry_count": { - "type": "integer", - "description": "Number of times to retry when sending data to the upstream server." + "description": "String to be attached as tag of the consumer.", + "default": "consumer" }, "queue_size": { "type": "integer", "description": "Maximum number of log entries to be sent on each message to the upstream server." }, - "queue": { - "type": "object", - "properties": { - "max_entries": { - "type": "integer", - "maximum": 1000000, - "minimum": 1, - "description": "Maximum number of entries that can be waiting on the queue.", - "default": 10000 - }, - "max_bytes": { - "type": "integer", - "description": "Maximum number of bytes that can be waiting on a queue, requires string content." - }, - "max_retry_time": { - "type": "number", - "description": "Time in seconds before the queue gives up calling a failed handler for a batch.", - "default": 60 - }, - "initial_retry_delay": { - "type": "number", - "maximum": 1000000, - "minimum": 0.001, - "description": "Time in seconds before the initial retry is made for a failing batch.", - "default": 0.01 - }, - "max_retry_delay": { - "type": "number", - "maximum": 1000000, - "minimum": 0.001, - "description": "Maximum time in seconds between retries, caps exponential backoff.", - "default": 60 - }, - "concurrency_limit": { - "type": "integer", - "enum": [ - -1, - 1 - ], - "description": "The number of of queue delivery timers. -1 indicates unlimited.", - "default": 1 - }, - "max_batch_size": { - "type": "integer", - "maximum": 1000000, - "minimum": 1, - "description": "Maximum number of entries that can be processed at a time.", - "default": 1 - }, - "max_coalescing_delay": { - "type": "number", - "maximum": 3600, - "minimum": 0, - "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.", - "default": 1 - } - } + "flush_timeout": { + "type": "number", + "description": "Optional time in seconds. If `queue_size` > 1, this is the max idle time before sending a log with less than `queue_size` records." }, "metrics": { "type": "array", "items": { "type": "object", "properties": { + "tags": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of tags" + }, "sample_rate": { "type": "number", "maximum": 1, @@ -148,13 +67,6 @@ "timer" ], "description": "Determines what sort of event the metric represents" - }, - "tags": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of tags" } }, "required": [ @@ -171,33 +83,121 @@ "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 8125 }, - "prefix": { + "status_tag": { "type": "string", - "description": "String to be attached as a prefix to a metric's name.", - "default": "kong" + "description": "String to be attached as the tag of the HTTP status.", + "default": "status" }, - "service_name_tag": { + "route_name_tag": { "type": "string", - "description": "String to be attached as the name of the service.", - "default": "name" + "description": "String to be attached as tag of the route name or ID." }, - "consumer_tag": { - "type": "string", - "description": "String to be attached as tag of the consumer.", - "default": "consumer" + "retry_count": { + "type": "integer", + "description": "Number of times to retry when sending data to the upstream server." }, - "flush_timeout": { - "type": "number", - "description": "Optional time in seconds. If `queue_size` > 1, this is the max idle time before sending a log with less than `queue_size` records." + "queue": { + "type": "object", + "properties": { + "max_bytes": { + "type": "integer", + "description": "Maximum number of bytes that can be waiting on a queue, requires string content." + }, + "max_retry_time": { + "type": "number", + "description": "Time in seconds before the queue gives up calling a failed handler for a batch.", + "default": 60 + }, + "initial_retry_delay": { + "type": "number", + "maximum": 1000000, + "minimum": 0.001, + "description": "Time in seconds before the initial retry is made for a failing batch.", + "default": 0.01 + }, + "max_retry_delay": { + "type": "number", + "maximum": 1000000, + "minimum": 0.001, + "description": "Maximum time in seconds between retries, caps exponential backoff.", + "default": 60 + }, + "concurrency_limit": { + "type": "integer", + "enum": [ + -1, + 1 + ], + "description": "The number of of queue delivery timers. -1 indicates unlimited.", + "default": 1 + }, + "max_batch_size": { + "type": "integer", + "maximum": 1000000, + "minimum": 1, + "description": "Maximum number of entries that can be processed at a time.", + "default": 1 + }, + "max_coalescing_delay": { + "type": "number", + "maximum": 3600, + "minimum": 0, + "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.", + "default": 1 + }, + "max_entries": { + "type": "integer", + "maximum": 1000000, + "minimum": 1, + "description": "Maximum number of entries that can be waiting on the queue.", + "default": 10000 + } + } }, "host": { "type": "string", "description": "A string representing a host name, such as example.com.", "default": "localhost", "x-referenceable": true + }, + "prefix": { + "type": "string", + "description": "String to be attached as a prefix to a metric's name.", + "default": "kong" + }, + "service_name_tag": { + "type": "string", + "description": "String to be attached as the name of the service.", + "default": "name" } } }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "tcp", + "tls", + "tls_passthrough", + "udp", + "ws", + "wss" + ], + "description": "A string representing a protocol, such as HTTP or HTTPS." + }, + "description": "A set of strings representing protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/Datakit.json b/app/_schemas/ai-gateway/policies/Datakit.json index 68564adf089..ac77bc75067 100644 --- a/app/_schemas/ai-gateway/policies/Datakit.json +++ b/app/_schemas/ai-gateway/policies/Datakit.json @@ -25,17 +25,21 @@ "resources": { "type": "object", "properties": { + "vault": { + "type": "object", + "maxLength": 64, + "minLength": 1, + "additionalProperties": { + "type": "string", + "maxLength": 4095, + "minLength": 1, + "x-referenceable": true, + "x-lua-required": true + } + }, "cache": { "type": "object", "properties": { - "strategy": { - "type": "string", - "enum": [ - "memory", - "redis" - ], - "description": "The backing data store in which to hold cache entities. Accepted values are: `memory` and `redis`." - }, "memory": { "type": "object", "properties": { @@ -49,7 +53,50 @@ "redis": { "type": "object", "properties": { - "read_timeout": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "send_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, @@ -62,18 +109,23 @@ "x-referenceable": true, "x-encrypted": true }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, "cloud_authentication": { "type": "object", "properties": { - "aws_assume_role_arn": { + "aws_access_key_id": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-encrypted": true, "x-referenceable": true }, - "aws_role_session_name": { + "aws_secret_access_key": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, @@ -89,15 +141,17 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_cache_name": { + "aws_assume_role_arn": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true }, - "aws_region": { + "aws_role_session_name": { "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true }, "azure_client_secret": { "type": "string", @@ -121,75 +175,24 @@ "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, "aws_is_serverless": { "type": "boolean", "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", "default": true - }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, "sentinel_nodes": { "type": "array", "items": { @@ -212,32 +215,22 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, "cluster_nodes": { "type": "array", "items": { "type": "object", "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, "port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 6379 - }, - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" } } }, @@ -249,57 +242,64 @@ "description": "A string representing an SNI (server name indication) value for TLS.", "x-referenceable": true }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, "connection_is_proxied": { "type": "boolean", "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", "default": false }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, "username": { "type": "string", "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true - }, - "database": { + "cluster_max_redirections": { "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + "description": "Maximum retry attempts for redirection.", + "default": 5 } } + }, + "strategy": { + "type": "string", + "enum": [ + "memory", + "redis" + ], + "description": "The backing data store in which to hold cache entities. Accepted values are: `memory` and `redis`." } } - }, - "vault": { - "type": "object", - "maxLength": 64, - "minLength": 1, - "additionalProperties": { - "type": "string", - "maxLength": 4095, - "minLength": 1, - "x-referenceable": true, - "x-lua-required": true - } } } }, @@ -314,36 +314,6 @@ { "type": "object", "properties": { - "else": { - "type": "array", - "items": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`." - }, - "maxLength": 64, - "minLength": 1, - "description": "nodes to execute if the input condition is `false`" - }, - "then": { - "type": "array", - "items": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`." - }, - "maxLength": 64, - "minLength": 1, - "description": "nodes to execute if the input condition is `true`" - }, - "input": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "branch node input" - }, "output": { "type": "string", "maxLength": 255, @@ -353,13 +323,13 @@ "outputs": { "type": "object", "properties": { - "then": { + "else": { "type": "string", "maxLength": 255, "minLength": 1, "description": "node output" }, - "else": { + "then": { "type": "string", "maxLength": 255, "minLength": 1, @@ -381,6 +351,36 @@ "branch" ], "x-terraform-transform-const": true + }, + "else": { + "type": "array", + "items": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`." + }, + "maxLength": 64, + "minLength": 1, + "description": "nodes to execute if the input condition is `false`" + }, + "then": { + "type": "array", + "items": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`." + }, + "maxLength": 64, + "minLength": 1, + "description": "nodes to execute if the input condition is `true`" + }, + "input": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "branch node input" } }, "title": "branch", @@ -389,6 +389,30 @@ { "type": "object", "properties": { + "inputs": { + "type": "object", + "properties": { + "data": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "The data to be cached." + }, + "key": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "The cache key." + }, + "ttl": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "The TTL in seconds." + } + }, + "description": "cache node inputs" + }, "output": { "type": "string", "maxLength": 255, @@ -398,29 +422,29 @@ "outputs": { "type": "object", "properties": { - "data": { + "miss": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "The data that was cached." + "description": "Signals a cache miss." }, - "hit": { + "stored": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "Signals a cache hit." + "description": "Signals whether data was stored in cache." }, - "miss": { + "data": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "Signals a cache miss." + "description": "The data that was cached." }, - "stored": { + "hit": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "Signals whether data was stored in cache." + "description": "Signals a cache hit." } }, "description": "cache node outputs" @@ -450,30 +474,6 @@ "maxLength": 255, "minLength": 1, "description": "cache node input" - }, - "inputs": { - "type": "object", - "properties": { - "data": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "The data to be cached." - }, - "key": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "The cache key." - }, - "ttl": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "The TTL in seconds." - } - }, - "description": "cache node inputs" } }, "title": "cache", @@ -482,56 +482,97 @@ { "type": "object", "properties": { + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2." + }, + "url": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." + }, + "name": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`.", + "x-lua-required": true + }, + "type": { + "type": "string", + "enum": [ + "call" + ], + "x-terraform-transform-const": true + }, + "method": { + "type": "string", + "maxLength": 32, + "minLength": 1, + "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters.", + "default": "GET" + }, + "ssl_server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS." + }, + "input": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "call node input" + }, "inputs": { "type": "object", "properties": { - "body": { + "proxy_auth_password": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "HTTP request body" + "description": "The password to authenticate with, if the forward proxy is protected by basic authentication." }, - "headers": { + "proxy_auth_username": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "HTTP request headers" + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication." }, - "http_proxy": { + "query": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "The HTTP proxy URL. This proxy server will be used for HTTP requests." + "description": "HTTP request query" }, - "https_proxy": { + "url": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "The HTTPS proxy URL. This proxy server will be used for HTTPS requests." + "description": "HTTP request URL" }, - "proxy_auth_password": { + "body": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "The password to authenticate with, if the forward proxy is protected by basic authentication." + "description": "HTTP request body" }, - "proxy_auth_username": { + "headers": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication." + "description": "HTTP request headers" }, - "query": { + "http_proxy": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "HTTP request query" + "description": "The HTTP proxy URL. This proxy server will be used for HTTP requests." }, - "url": { + "https_proxy": { "type": "string", "maxLength": 255, "minLength": 1, - "description": "HTTP request URL" + "description": "The HTTPS proxy URL. This proxy server will be used for HTTPS requests." } }, "description": "call node inputs" @@ -542,34 +583,9 @@ "minLength": 1, "description": "call node output" }, - "method": { - "type": "string", - "maxLength": 32, - "minLength": 1, - "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters.", - "default": "GET" - }, - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2." - }, - "input": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "call node input" - }, "outputs": { "type": "object", "properties": { - "status": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "HTTP response status code" - }, "body": { "type": "string", "maxLength": 255, @@ -587,36 +603,20 @@ "maxLength": 255, "minLength": 1, "description": "The raw, non-decoded HTTP response body" + }, + "status": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "HTTP response status code" } }, "description": "call node outputs" }, - "name": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`.", - "x-lua-required": true - }, - "type": { - "type": "string", - "enum": [ - "call" - ], - "x-terraform-transform-const": true - }, - "ssl_server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS." - }, "ssl_verify": { "type": "boolean", "description": "Whether to verify the TLS certificate when making HTTPS requests.", "default": true - }, - "url": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." } }, "title": "call", @@ -625,16 +625,6 @@ { "type": "object", "properties": { - "status": { - "type": "integer", - "maximum": 599, - "minimum": 200, - "description": "HTTP status code", - "default": 200 - }, - "warn_headers_sent": { - "type": "boolean" - }, "input": { "type": "string", "maxLength": 255, @@ -672,6 +662,16 @@ "exit" ], "x-terraform-transform-const": true + }, + "status": { + "type": "integer", + "maximum": 599, + "minimum": 200, + "description": "HTTP status code", + "default": 200 + }, + "warn_headers_sent": { + "type": "boolean" } }, "title": "exit", @@ -731,26 +731,17 @@ { "type": "object", "properties": { - "attributes_block_name": { - "type": "string", - "maxLength": 32, - "minLength": 1 - }, - "attributes_name_prefix": { - "type": "string", - "maxLength": 32, - "minLength": 1 - }, "root_element_name": { "type": "string", "maxLength": 64, "minLength": 1 }, - "input": { + "text_block_name": { "type": "string", - "maxLength": 255, + "maxLength": 32, "minLength": 1, - "description": "JSON string or table" + "description": "The name of the block to treat as XML text content.", + "default": "#text" }, "inputs": { "type": "object", @@ -767,13 +758,6 @@ "minLength": 1, "description": "XML document converted from JSON" }, - "text_block_name": { - "type": "string", - "maxLength": 32, - "minLength": 1, - "description": "The name of the block to treat as XML text content.", - "default": "#text" - }, "name": { "type": "string", "maxLength": 255, @@ -781,12 +765,28 @@ "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`.", "x-lua-required": true }, + "attributes_block_name": { + "type": "string", + "maxLength": 32, + "minLength": 1 + }, + "input": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "JSON string or table" + }, "type": { "type": "string", "enum": [ "json_to_xml" ], "x-terraform-transform-const": true + }, + "attributes_name_prefix": { + "type": "string", + "maxLength": 32, + "minLength": 1 } }, "title": "json_to_xml", @@ -810,12 +810,6 @@ "outputs": { "type": "object", "properties": { - "payload": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "Decoded JWT payload (claims)" - }, "signature": { "type": "string", "maxLength": 255, @@ -827,6 +821,12 @@ "maxLength": 255, "minLength": 1, "description": "Decoded JWT header (alg, kid, typ)" + }, + "payload": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "Decoded JWT payload (claims)" } }, "description": "jwt_decode node outputs" @@ -852,6 +852,36 @@ { "type": "object", "properties": { + "not_before": { + "type": "integer", + "description": "Seconds until token becomes valid (for nbf claim)", + "default": 0 + }, + "inputs": { + "type": "object", + "properties": { + "key": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "Signing key (PEM, JWK JSON string, or HMAC secret)" + }, + "claims": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "Dynamic claims to include" + } + }, + "description": "jwt_sign node inputs" + }, + "type": { + "type": "string", + "enum": [ + "jwt_sign" + ], + "x-terraform-transform-const": true + }, "expires_in": { "type": "integer", "description": "Seconds until token expires (for exp claim)", @@ -861,23 +891,24 @@ "type": "string", "description": "Key ID for header" }, - "inputs": { + "static_claims": { "type": "object", - "properties": { - "claims": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "Dynamic claims to include" - }, - "key": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "Signing key (PEM, JWK JSON string, or HMAC secret)" - } + "additionalProperties": { + "type": "string" }, - "description": "jwt_sign node inputs" + "description": "Static claims always included", + "default": {} + }, + "typ": { + "type": "string", + "description": "Token type for header", + "default": "JWT" + }, + "input": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "jwt_sign node input" }, "output": { "type": "string", @@ -934,37 +965,6 @@ "RS512" ], "description": "Signing algorithm" - }, - "not_before": { - "type": "integer", - "description": "Seconds until token becomes valid (for nbf claim)", - "default": 0 - }, - "static_claims": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Static claims always included", - "default": {} - }, - "typ": { - "type": "string", - "description": "Token type for header", - "default": "JWT" - }, - "input": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "jwt_sign node input" - }, - "type": { - "type": "string", - "enum": [ - "jwt_sign" - ], - "x-terraform-transform-const": true } }, "title": "jwt_sign", @@ -976,6 +976,16 @@ { "type": "object", "properties": { + "validate_exp": { + "type": "boolean", + "description": "Validate expiration claim", + "default": true + }, + "validate_nbf": { + "type": "boolean", + "description": "Validate not-before claim", + "default": true + }, "input": { "type": "string", "maxLength": 255, @@ -988,50 +998,26 @@ "minLength": 1, "description": "jwt_verify node output" }, - "outputs": { - "type": "object", - "properties": { - "claims": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "JWT payload claims" - }, - "header": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "JWT header" - } - }, - "description": "jwt_verify node outputs" + "name": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`.", + "x-lua-required": true }, - "audiences": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Allowed audiences (empty = any)", - "default": [] + "leeway": { + "type": "integer", + "description": "Allowed clock skew in seconds for exp/nbf validation", + "default": 0 }, - "issuers": { + "required_claims": { "type": "array", "items": { "type": "string" }, - "description": "Allowed issuers (empty = any)", + "description": "Claims that must be present", "default": [] }, - "validate_exp": { - "type": "boolean", - "description": "Validate expiration claim", - "default": true - }, - "validate_nbf": { - "type": "boolean", - "description": "Validate not-before claim", - "default": true - }, "inputs": { "type": "object", "properties": { @@ -1050,12 +1036,23 @@ }, "description": "jwt_verify node inputs" }, - "name": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`.", - "x-lua-required": true + "outputs": { + "type": "object", + "properties": { + "claims": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "JWT payload claims" + }, + "header": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "JWT header" + } + }, + "description": "jwt_verify node outputs" }, "type": { "type": "string", @@ -1087,17 +1084,20 @@ "description": "Allowed signing algorithms (empty = any supported)", "default": [] }, - "leeway": { - "type": "integer", - "description": "Allowed clock skew in seconds for exp/nbf validation", - "default": 0 + "audiences": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Allowed audiences (empty = any)", + "default": [] }, - "required_claims": { + "issuers": { "type": "array", "items": { "type": "string" }, - "description": "Claims that must be present", + "description": "Allowed issuers (empty = any)", "default": [] } }, @@ -1107,6 +1107,21 @@ { "type": "object", "properties": { + "content_type": { + "type": "string", + "enum": [ + "application/json", + "application/octet-stream", + "text/plain" + ], + "description": "The expected mime type of the property value. When set to `application/json`, SET operations will JSON-encode input data before writing it, and GET operations will JSON-decode output data after reading it. Otherwise, this setting has no effect." + }, + "property": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "The property name to get/set" + }, "input": { "type": "string", "maxLength": 255, @@ -1132,21 +1147,6 @@ "property" ], "x-terraform-transform-const": true - }, - "content_type": { - "type": "string", - "enum": [ - "application/json", - "application/octet-stream", - "text/plain" - ], - "description": "The expected mime type of the property value. When set to `application/json`, SET operations will JSON-encode input data before writing it, and GET operations will JSON-decode output data after reading it. Otherwise, this setting has no effect." - }, - "property": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "The property name to get/set" } }, "title": "property", @@ -1203,28 +1203,15 @@ { "type": "object", "properties": { - "input": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "XML document string" - }, - "output": { - "type": "string", - "maxLength": 255, - "minLength": 1, - "description": "a map object converted from XML document. If connected to `request.body` or `response.body`, the output will be a JSON object." - }, - "attributes_block_name": { - "type": "string", - "maxLength": 32, - "minLength": 1 - }, "attributes_name_prefix": { "type": "string", "maxLength": 32, "minLength": 1 }, + "recognize_type": { + "type": "boolean", + "default": true + }, "text_as_property": { "type": "boolean", "default": false @@ -1234,6 +1221,12 @@ "maxLength": 256, "minLength": 1 }, + "input": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "XML document string" + }, "name": { "type": "string", "maxLength": 255, @@ -1241,22 +1234,29 @@ "description": "A label that uniquely identifies the node within the policy configuration so that it can be used for input/output connections. Must be valid `snake_case` or `kebab-case`.", "x-lua-required": true }, - "type": { + "attributes_block_name": { "type": "string", - "enum": [ - "xml_to_json" - ], - "x-terraform-transform-const": true - }, - "recognize_type": { - "type": "boolean", - "default": true + "maxLength": 32, + "minLength": 1 }, "text_block_name": { "type": "string", "maxLength": 32, "minLength": 1, "default": "#text" + }, + "output": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "description": "a map object converted from XML document. If connected to `request.body` or `response.body`, the output will be a JSON object." + }, + "type": { + "type": "string", + "enum": [ + "xml_to_json" + ], + "x-terraform-transform-const": true } }, "title": "xml_to_json", @@ -1272,7 +1272,7 @@ "nodes" ] }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -1280,9 +1280,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "consumer": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -1290,9 +1290,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "consumer_group": { + "route": { "type": "object", "properties": { "id": { @@ -1300,9 +1300,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -1310,7 +1310,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/ExitTransformer.json b/app/_schemas/ai-gateway/policies/ExitTransformer.json index 9afa6a99db2..6f10ccab84e 100644 --- a/app/_schemas/ai-gateway/policies/ExitTransformer.json +++ b/app/_schemas/ai-gateway/policies/ExitTransformer.json @@ -1,5 +1,24 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { @@ -24,25 +43,6 @@ "functions" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/FileLog.json b/app/_schemas/ai-gateway/policies/FileLog.json index 5ebcb725f51..a25db6d363f 100644 --- a/app/_schemas/ai-gateway/policies/FileLog.json +++ b/app/_schemas/ai-gateway/policies/FileLog.json @@ -1,5 +1,29 @@ { "properties": { + "config": { + "type": "object", + "properties": { + "path": { + "type": "string", + "description": "The file path of the output log file. The policy creates the log file if it doesn't exist yet." + }, + "reopen": { + "type": "boolean", + "description": "Determines whether the log file is closed and reopened on every request.", + "default": false + }, + "custom_fields_by_lua": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Lua code as a key-value map" + } + }, + "required": [ + "path" + ] + }, "protocols": { "type": "array", "items": { @@ -26,30 +50,6 @@ "https" ] }, - "config": { - "type": "object", - "properties": { - "path": { - "type": "string", - "description": "The file path of the output log file. The policy creates the log file if it doesn't exist yet." - }, - "reopen": { - "type": "boolean", - "description": "Determines whether the log file is closed and reopened on every request.", - "default": false - }, - "custom_fields_by_lua": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Lua code as a key-value map" - } - }, - "required": [ - "path" - ] - }, "service": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/ForwardProxy.json b/app/_schemas/ai-gateway/policies/ForwardProxy.json index a7c70270148..ceb09f87a8b 100644 --- a/app/_schemas/ai-gateway/policies/ForwardProxy.json +++ b/app/_schemas/ai-gateway/policies/ForwardProxy.json @@ -22,6 +22,16 @@ "config": { "type": "object", "properties": { + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + }, "https_proxy_port": { "type": "integer", "maximum": 65535, @@ -41,21 +51,6 @@ "description": "The username to authenticate with, if the forward proxy is protected\nby basic authentication.", "x-referenceable": true }, - "https_verify": { - "type": "boolean", - "description": "Whether the server certificate will be verified according to the CA certificates specified in lua_ssl_trusted_certificate.", - "default": true - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "http_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, "auth_password": { "type": "string", "description": "The password to authenticate with, if the forward proxy is protected\nby basic authentication.", @@ -75,6 +70,11 @@ "https_proxy_host": { "type": "string", "description": "A string representing a host name, such as example.com." + }, + "https_verify": { + "type": "boolean", + "description": "Whether the server certificate will be verified according to the CA certificates specified in lua_ssl_trusted_certificate.", + "default": true } } }, diff --git a/app/_schemas/ai-gateway/policies/GraphqlProxyCacheAdvanced.json b/app/_schemas/ai-gateway/policies/GraphqlProxyCacheAdvanced.json index 0fc22b290a4..2f3040e83f1 100644 --- a/app/_schemas/ai-gateway/policies/GraphqlProxyCacheAdvanced.json +++ b/app/_schemas/ai-gateway/policies/GraphqlProxyCacheAdvanced.json @@ -1,27 +1,15 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { + "vary_headers": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Relevant headers considered for the cache key. If undefined, none of the headers are taken into consideration." + }, "strategy": { "type": "string", "enum": [ @@ -55,49 +43,21 @@ "default": "127.0.0.1", "x-referenceable": true }, - "sentinel_username": { + "password": { "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-encrypted": true, "x-referenceable": true }, - "sentinel_password": { + "sentinel_username": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "read_timeout": { + "database": { "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 }, "cluster_nodes": { "type": "array", @@ -121,39 +81,20 @@ "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "ssl": { + "ssl_verify": { "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true }, - "server_name": { + "username": { "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, "sentinel_master": { "type": "string", "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, "sentinel_nodes": { "type": "array", "items": { @@ -176,72 +117,70 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true }, - "connect_timeout": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "send_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "password": { + "sentinel_password": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", "x-referenceable": true, "x-encrypted": true }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, "cloud_authentication": { "type": "object", "properties": { - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_secret": { - "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, "azure_tenant_id": { "type": "string", "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "auth_provider": { "type": "string", @@ -253,17 +192,28 @@ "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, "aws_is_serverless": { "type": "boolean", "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", "default": true }, - "aws_assume_role_arn": { + "aws_access_key_id": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-encrypted": true, "x-referenceable": true }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, "aws_role_session_name": { "type": "string", "description": "The session name for the temporary credentials when assuming the IAM role.", @@ -274,6 +224,30 @@ "type": "string", "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-encrypted": true, + "x-referenceable": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." @@ -284,6 +258,20 @@ "minimum": 1, "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", "default": 256 + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false } } }, @@ -291,17 +279,29 @@ "type": "boolean", "description": "Unhandled errors while trying to retrieve a cache entry (such as redis down) are resolved with `Bypass`, with the request going upstream.", "default": false - }, - "vary_headers": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Relevant headers considered for the cache key. If undefined, none of the headers are taken into consideration." } } }, - "route": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "consumer": { "type": "object", "properties": { "id": { @@ -309,9 +309,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -319,9 +319,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -329,7 +329,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "x-supported-partials": [ diff --git a/app/_schemas/ai-gateway/policies/GraphqlRateLimitingAdvanced.json b/app/_schemas/ai-gateway/policies/GraphqlRateLimitingAdvanced.json index 537db10300b..e8ec9d0b178 100644 --- a/app/_schemas/ai-gateway/policies/GraphqlRateLimitingAdvanced.json +++ b/app/_schemas/ai-gateway/policies/GraphqlRateLimitingAdvanced.json @@ -1,8 +1,37 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "hide_client_headers": { + "type": "boolean", + "description": "Optionally hide informative response headers. Available options: `true` or `false`.", + "default": false + }, + "score_factor": { + "type": "number", + "description": "A scoring factor to multiply (or divide) the cost. The `score_factor` must always be greater than 0.", + "default": 1 + }, "identifier": { "type": "string", "enum": [ @@ -13,17 +42,6 @@ "description": "How to define the rate limit key. Can be `ip`, `credential`, `consumer`.", "default": "consumer" }, - "window_size": { - "type": "array", - "items": { - "type": "number" - }, - "description": "One or more window sizes to apply a limit to (defined in seconds)." - }, - "sync_rate": { - "type": "number", - "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 syncs the counters in that many number of seconds." - }, "namespace": { "type": "string", "description": "The rate limiting namespace to use for this policy instance. This namespace is used to share rate limiting counters across different instances. If it is not provided, a random UUID is generated. NOTE: For the policy instances sharing the same namespace, all the configurations that are required for synchronizing counters, e.g. `strategy`, `redis`, `sync_rate`, `window_size`, `dictionary_name`, need to be the same." @@ -42,32 +60,6 @@ "description": "The shared dictionary where counters will be stored until the next sync cycle.", "default": "kong_rate_limiting_counters" }, - "score_factor": { - "type": "number", - "description": "A scoring factor to multiply (or divide) the cost. The `score_factor` must always be greater than 0.", - "default": 1 - }, - "window_type": { - "type": "string", - "enum": [ - "fixed", - "sliding" - ], - "description": "Sets the time window to either `sliding` or `fixed`.", - "default": "sliding" - }, - "limit": { - "type": "array", - "items": { - "type": "number" - }, - "description": "One or more requests-per-window limits to apply." - }, - "hide_client_headers": { - "type": "boolean", - "description": "Optionally hide informative response headers. Available options: `true` or `false`.", - "default": false - }, "cost_strategy": { "type": "string", "enum": [ @@ -85,86 +77,26 @@ "redis": { "type": "object", "properties": { - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, "sentinel_password": { "type": "string", "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", "x-referenceable": true, "x-encrypted": true }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "sentinel_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, "cloud_authentication": { "type": "object", "properties": { - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true }, "aws_access_key_id": { "type": "string", @@ -172,21 +104,21 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_secret_access_key": { + "aws_role_session_name": { "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "azure_client_secret": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "gcp_service_account_json": { + "azure_tenant_id": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, @@ -200,54 +132,51 @@ "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_assume_role_arn": { + "aws_cache_name": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true }, - "azure_client_id": { + "aws_region": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "azure_client_secret": { - "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true }, - "azure_tenant_id": { + "aws_secret_access_key": { "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-encrypted": true, "x-referenceable": true }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_region": { + "aws_assume_role_arn": { "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, - "cluster_nodes": { + "sentinel_nodes": { "type": "array", "items": { "type": "object", "properties": { - "ip": { + "host": { "type": "string", "description": "A string representing a host name, such as example.com.", "default": "127.0.0.1" @@ -262,7 +191,7 @@ } }, "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, "ssl_verify": { "type": "boolean", @@ -274,11 +203,53 @@ "description": "A string representing an SNI (server name indication) value for TLS.", "x-referenceable": true }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, "connection_is_proxied": { "type": "boolean", "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", "default": false }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, "host": { "type": "string", "description": "A string representing a host name, such as example.com.", @@ -292,6 +263,22 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, "send_timeout": { "type": "integer", "maximum": 2147483646, @@ -299,27 +286,32 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, "username": { "type": "string", "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true } } }, @@ -327,6 +319,33 @@ "type": "boolean", "description": "pass all downstream headers to the upstream graphql server in introspection request", "default": false + }, + "window_size": { + "type": "array", + "items": { + "type": "number" + }, + "description": "One or more window sizes to apply a limit to (defined in seconds)." + }, + "window_type": { + "type": "string", + "enum": [ + "fixed", + "sliding" + ], + "description": "Sets the time window to either `sliding` or `fixed`.", + "default": "sliding" + }, + "limit": { + "type": "array", + "items": { + "type": "number" + }, + "description": "One or more requests-per-window limits to apply." + }, + "sync_rate": { + "type": "number", + "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 syncs the counters in that many number of seconds." } }, "required": [ @@ -335,25 +354,6 @@ "window_size" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/GrpcGateway.json b/app/_schemas/ai-gateway/policies/GrpcGateway.json index c1283223e7f..bc62669c101 100644 --- a/app/_schemas/ai-gateway/policies/GrpcGateway.json +++ b/app/_schemas/ai-gateway/policies/GrpcGateway.json @@ -35,7 +35,7 @@ } } }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -43,9 +43,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -53,9 +53,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -63,7 +63,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/GrpcWeb.json b/app/_schemas/ai-gateway/policies/GrpcWeb.json index 3c16da087b8..122718cceb6 100644 --- a/app/_schemas/ai-gateway/policies/GrpcWeb.json +++ b/app/_schemas/ai-gateway/policies/GrpcWeb.json @@ -1,5 +1,23 @@ { "properties": { + "config": { + "type": "object", + "properties": { + "proto": { + "type": "string", + "description": "If present, describes the gRPC types and methods. Required to support payload transcoding. When absent, the web client must use application/grpw-web+proto content." + }, + "pass_stripped_path": { + "type": "boolean", + "description": "If set to `true` causes the policy to pass the stripped request path to the upstream gRPC service." + }, + "allow_origin_header": { + "type": "string", + "description": "The value of the `Access-Control-Allow-Origin` header in the response to the gRPC-Web client.", + "default": "*" + } + } + }, "protocols": { "type": "array", "items": { @@ -26,25 +44,7 @@ "https" ] }, - "config": { - "type": "object", - "properties": { - "proto": { - "type": "string", - "description": "If present, describes the gRPC types and methods. Required to support payload transcoding. When absent, the web client must use application/grpw-web+proto content." - }, - "pass_stripped_path": { - "type": "boolean", - "description": "If set to `true` causes the policy to pass the stripped request path to the upstream gRPC service." - }, - "allow_origin_header": { - "type": "string", - "description": "The value of the `Access-Control-Allow-Origin` header in the response to the gRPC-Web client.", - "default": "*" - } - } - }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -52,9 +52,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -62,9 +62,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -72,7 +72,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/HeaderCertAuth.json b/app/_schemas/ai-gateway/policies/HeaderCertAuth.json index 05c1113c797..44991ae2bac 100644 --- a/app/_schemas/ai-gateway/policies/HeaderCertAuth.json +++ b/app/_schemas/ai-gateway/policies/HeaderCertAuth.json @@ -3,10 +3,29 @@ "config": { "type": "object", "properties": { - "ssl_verify": { + "consumer_by": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "custom_id", + "username" + ] + }, + "description": "Whether to match the subject name of the client-supplied certificate against consumer's `username` and/or `custom_id` attribute. If set to `[]` (the empty array), then auto-matching is disabled.", + "default": [ + "custom_id", + "username" + ] + }, + "skip_consumer_lookup": { "type": "boolean", - "description": "This option enables verification of the certificate presented by the server of the OCSP responder's URL and by the server of the CRL Distribution Point.", - "default": true + "description": "Skip consumer lookup once certificate is trusted against the configured CA list.", + "default": false + }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." }, "anonymous": { "type": "string", @@ -19,6 +38,23 @@ }, "description": "List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (`id`)." }, + "cache_ttl": { + "type": "number", + "description": "Cache expiry time in seconds.", + "default": 60 + }, + "certificate_header_name": { + "type": "string", + "description": "Name of the header that contains the certificate, received from the WAF or other L7 downstream proxy." + }, + "certificate_header_format": { + "type": "string", + "enum": [ + "base64_encoded", + "url_encoded" + ], + "description": "Format of the certificate header. Supported formats: `base64_encoded`, `url_encoded`." + }, "revocation_check_mode": { "type": "string", "enum": [ @@ -29,9 +65,20 @@ "description": "Controls client certificate revocation check behavior. If set to `SKIP`, no revocation check is performed. If set to `IGNORE_CA_ERROR`, the policy respects the revocation status when either OCSP or CRL URL is set, and doesn't fail on network issues. If set to `STRICT`, the policy only treats the certificate as valid when it's able to verify the revocation status.", "default": "IGNORE_CA_ERROR" }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." + "http_timeout": { + "type": "number", + "description": "HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.", + "default": 30000 + }, + "cert_cache_ttl": { + "type": "number", + "description": "The length of time in milliseconds between refreshes of the revocation check status cache.", + "default": 60000 + }, + "ssl_verify": { + "type": "boolean", + "description": "This option enables verification of the certificate presented by the server of the OCSP responder's URL and by the server of the CRL Distribution Point.", + "default": true }, "http_proxy_port": { "type": "integer", @@ -39,67 +86,22 @@ "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive." }, - "allow_partial_chain": { - "type": "boolean", - "description": "Allow certificate verification with only an intermediate certificate. When this is enabled, you don't need to upload the full chain to Kong Certificates.", - "default": false - }, - "default_consumer": { - "type": "string", - "description": "The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." - }, "https_proxy_port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive." }, - "certificate_header_name": { - "type": "string", - "description": "Name of the header that contains the certificate, received from the WAF or other L7 downstream proxy." - }, - "certificate_header_format": { - "type": "string", - "enum": [ - "base64_encoded", - "url_encoded" - ], - "description": "Format of the certificate header. Supported formats: `base64_encoded`, `url_encoded`." - }, "secure_source": { "type": "boolean", "description": "Whether to secure the source of the request. If set to `true`, the policy will only allow requests from trusted IPs (configured by the `trusted_ips` config option).", "default": true }, - "consumer_by": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "custom_id", - "username" - ] - }, - "description": "Whether to match the subject name of the client-supplied certificate against consumer's `username` and/or `custom_id` attribute. If set to `[]` (the empty array), then auto-matching is disabled.", - "default": [ - "custom_id", - "username" - ] - }, - "skip_consumer_lookup": { + "allow_partial_chain": { "type": "boolean", - "description": "Skip consumer lookup once certificate is trusted against the configured CA list.", + "description": "Allow certificate verification with only an intermediate certificate. When this is enabled, you don't need to upload the full chain to Kong Certificates.", "default": false }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "cache_ttl": { - "type": "number", - "description": "Cache expiry time in seconds.", - "default": 60 - }, "authenticated_group_by": { "type": "string", "enum": [ @@ -109,15 +111,13 @@ "description": "Certificate property to use as the authenticated group. Valid values are `CN` (Common Name) or `DN` (Distinguished Name). Once `skip_consumer_lookup` is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL policy (not covered here) and create allowed or denied groups of users.", "default": "CN" }, - "http_timeout": { - "type": "number", - "description": "HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.", - "default": 30000 + "default_consumer": { + "type": "string", + "description": "The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." }, - "cert_cache_ttl": { - "type": "number", - "description": "The length of time in milliseconds between refreshes of the revocation check status cache.", - "default": 60000 + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." } }, "required": [ @@ -155,7 +155,7 @@ "description": "Custom type for representing a foreign key with a null value allowed.", "x-foreign": true }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -163,9 +163,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -173,7 +173,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/HmacAuth.json b/app/_schemas/ai-gateway/policies/HmacAuth.json index 1791029ba0e..27cc531348a 100644 --- a/app/_schemas/ai-gateway/policies/HmacAuth.json +++ b/app/_schemas/ai-gateway/policies/HmacAuth.json @@ -1,27 +1,18 @@ { "properties": { + "model": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "Custom type for representing a foreign key with a null value allowed.", + "x-foreign": true + }, "config": { "type": "object", "properties": { - "hide_credentials": { - "type": "boolean", - "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service.", - "default": true - }, - "clock_skew": { - "type": "number", - "description": "Clock skew in seconds to prevent replay attacks.", - "default": 300 - }, - "anonymous": { - "type": "string", - "description": "An optional string (Consumer UUID or username) value to use as an “anonymous” consumer if authentication fails." - }, - "validate_request_body": { - "type": "boolean", - "description": "A boolean value telling the policy to enable body validation.", - "default": false - }, "enforce_headers": { "type": "array", "items": { @@ -53,6 +44,25 @@ "realm": { "type": "string", "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." + }, + "hide_credentials": { + "type": "boolean", + "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service.", + "default": true + }, + "clock_skew": { + "type": "number", + "description": "Clock skew in seconds to prevent replay attacks.", + "default": 300 + }, + "anonymous": { + "type": "string", + "description": "An optional string (Consumer UUID or username) value to use as an “anonymous” consumer if authentication fails." + }, + "validate_request_body": { + "type": "boolean", + "description": "A boolean value telling the policy to enable body validation.", + "default": false } } }, @@ -79,16 +89,6 @@ "wss" ] }, - "model": { - "type": "object", - "properties": { - "id": { - "type": "string" - } - }, - "description": "Custom type for representing a foreign key with a null value allowed.", - "x-foreign": true - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/HttpLog.json b/app/_schemas/ai-gateway/policies/HttpLog.json index fce922fa26a..a45adc531f3 100644 --- a/app/_schemas/ai-gateway/policies/HttpLog.json +++ b/app/_schemas/ai-gateway/policies/HttpLog.json @@ -1,13 +1,34 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "tcp", + "tls", + "tls_passthrough", + "udp", + "ws", + "wss" + ], + "description": "A string representing a protocol, such as HTTP or HTTPS." + }, + "description": "A set of strings representing protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { - "keepalive": { - "type": "number", - "description": "An optional value in milliseconds that defines how long an idle connection will live before being closed.", - "default": 60000 - }, "queue": { "type": "object", "properties": { @@ -73,12 +94,6 @@ }, "description": "Lua code as a key-value map" }, - "http_endpoint": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "x-referenceable": true, - "x-encrypted": true - }, "method": { "type": "string", "enum": [ @@ -103,17 +118,10 @@ "description": "An optional timeout in milliseconds when sending data to the upstream server.", "default": 10000 }, - "retry_count": { - "type": "integer", - "description": "Number of times to retry when sending data to the upstream server." - }, - "queue_size": { - "type": "integer", - "description": "Maximum number of log entries to be sent on each message to the upstream server." - }, - "flush_timeout": { + "keepalive": { "type": "number", - "description": "Optional time in seconds. If `queue_size` > 1, this is the max idle time before sending a log with less than `queue_size` records." + "description": "An optional value in milliseconds that defines how long an idle connection will live before being closed.", + "default": 60000 }, "headers": { "type": "object", @@ -122,42 +130,34 @@ }, "description": "An optional table of headers included in the HTTP message to the upstream server. Values are indexed by header name, and each header name accepts a single string." }, + "http_endpoint": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "x-referenceable": true, + "x-encrypted": true + }, "ssl_verify": { "type": "boolean", "description": "When using TLS, this option enables verification of the certificate presented by the server.", "default": true + }, + "retry_count": { + "type": "integer", + "description": "Number of times to retry when sending data to the upstream server." + }, + "queue_size": { + "type": "integer", + "description": "Maximum number of log entries to be sent on each message to the upstream server." + }, + "flush_timeout": { + "type": "number", + "description": "Optional time in seconds. If `queue_size` > 1, this is the max idle time before sending a log with less than `queue_size` records." } }, "required": [ "http_endpoint" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "tcp", - "tls", - "tls_passthrough", - "udp", - "ws", - "wss" - ], - "description": "A string representing a protocol, such as HTTP or HTTPS." - }, - "description": "A set of strings representing protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/InjectionProtection.json b/app/_schemas/ai-gateway/policies/InjectionProtection.json index ff024f3dd82..f1dc1a85dcb 100644 --- a/app/_schemas/ai-gateway/policies/InjectionProtection.json +++ b/app/_schemas/ai-gateway/policies/InjectionProtection.json @@ -22,18 +22,6 @@ "config": { "type": "object", "properties": { - "error_status_code": { - "type": "integer", - "maximum": 499, - "minimum": 400, - "description": "The response status code when validation fails.", - "default": 400 - }, - "error_message": { - "type": "string", - "description": "The response message when validation fails", - "default": "Bad Request" - }, "injection_types": { "type": "array", "items": { @@ -99,6 +87,18 @@ ], "description": "Enforcement mode of the security policy.", "default": "block" + }, + "error_status_code": { + "type": "integer", + "maximum": 499, + "minimum": 400, + "description": "The response status code when validation fails.", + "default": 400 + }, + "error_message": { + "type": "string", + "description": "The response message when validation fails", + "default": "Bad Request" } } }, diff --git a/app/_schemas/ai-gateway/policies/IpRestriction.json b/app/_schemas/ai-gateway/policies/IpRestriction.json index 1486fd11487..9b90709d82d 100644 --- a/app/_schemas/ai-gateway/policies/IpRestriction.json +++ b/app/_schemas/ai-gateway/policies/IpRestriction.json @@ -31,10 +31,6 @@ "config": { "type": "object", "properties": { - "message": { - "type": "string", - "description": "The message to send as a response body to rejected requests." - }, "allow": { "type": "array", "items": { @@ -54,10 +50,14 @@ "status": { "type": "number", "description": "The HTTP status of the requests that will be rejected by the policy." + }, + "message": { + "type": "string", + "description": "The message to send as a response body to rejected requests." } } }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -65,9 +65,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "consumer": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -75,9 +75,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "consumer_group": { + "route": { "type": "object", "properties": { "id": { @@ -85,9 +85,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -95,7 +95,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/Jq.json b/app/_schemas/ai-gateway/policies/Jq.json index a0ef0b523d2..6f812c37487 100644 --- a/app/_schemas/ai-gateway/policies/Jq.json +++ b/app/_schemas/ai-gateway/policies/Jq.json @@ -1,14 +1,34 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { - "response_jq_program": { - "type": "string" - }, "response_jq_program_options": { "type": "object", "properties": { + "sort_keys": { + "type": "boolean", + "default": false + }, "compact_output": { "type": "boolean", "default": true @@ -24,10 +44,6 @@ "ascii_output": { "type": "boolean", "default": false - }, - "sort_keys": { - "type": "boolean", - "default": false } }, "default": {} @@ -58,10 +74,6 @@ "request_jq_program_options": { "type": "object", "properties": { - "compact_output": { - "type": "boolean", - "default": true - }, "raw_output": { "type": "boolean", "default": false @@ -77,6 +89,10 @@ "sort_keys": { "type": "boolean", "default": false + }, + "compact_output": { + "type": "boolean", + "default": true } }, "default": {} @@ -89,29 +105,13 @@ "default": [ "application/json" ] + }, + "response_jq_program": { + "type": "string" } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -119,9 +119,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -129,9 +129,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -139,7 +139,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/JsonThreatProtection.json b/app/_schemas/ai-gateway/policies/JsonThreatProtection.json index f045256b859..e45d91ba59b 100644 --- a/app/_schemas/ai-gateway/policies/JsonThreatProtection.json +++ b/app/_schemas/ai-gateway/policies/JsonThreatProtection.json @@ -1,38 +1,28 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "max_array_element_count": { + "max_body_size": { "type": "integer", "maximum": 2147483648, "minimum": -1, - "description": "Max number of elements in an array. -1 means unlimited.", + "description": "Max size of the request body. -1 means unlimited.", + "default": 8192 + }, + "max_object_entry_count": { + "type": "integer", + "maximum": 2147483648, + "minimum": -1, + "description": "Max number of entries in an object. -1 means unlimited.", "default": -1 }, - "allow_duplicate_object_entry_name": { - "type": "boolean", - "description": "Allow or disallow duplicate object entry name.", - "default": true + "max_object_entry_name_length": { + "type": "integer", + "maximum": 2147483648, + "minimum": -1, + "description": "Max string length of object name. -1 means unlimited.", + "default": -1 }, "allow_non_json_requests": { "type": "boolean", @@ -48,23 +38,30 @@ "description": "Enforcement mode of the security policy.", "default": "block" }, + "error_status_code": { + "type": "integer", + "maximum": 499, + "minimum": 400, + "description": "The response status code when validation fails.", + "default": 400 + }, "error_message": { "type": "string", "description": "The response message when validation fails", "default": "Bad Request" }, - "max_body_size": { + "max_container_depth": { "type": "integer", "maximum": 2147483648, "minimum": -1, - "description": "Max size of the request body. -1 means unlimited.", - "default": 8192 + "description": "Max nested depth of objects and arrays. -1 means unlimited.", + "default": -1 }, - "max_object_entry_name_length": { + "max_array_element_count": { "type": "integer", "maximum": 2147483648, "minimum": -1, - "description": "Max string length of object name. -1 means unlimited.", + "description": "Max number of elements in an array. -1 means unlimited.", "default": -1 }, "max_string_value_length": { @@ -74,29 +71,32 @@ "description": "Max string value length. -1 means unlimited.", "default": -1 }, - "error_status_code": { - "type": "integer", - "maximum": 499, - "minimum": 400, - "description": "The response status code when validation fails.", - "default": 400 - }, - "max_container_depth": { - "type": "integer", - "maximum": 2147483648, - "minimum": -1, - "description": "Max nested depth of objects and arrays. -1 means unlimited.", - "default": -1 - }, - "max_object_entry_count": { - "type": "integer", - "maximum": 2147483648, - "minimum": -1, - "description": "Max number of entries in an object. -1 means unlimited.", - "default": -1 + "allow_duplicate_object_entry_name": { + "type": "boolean", + "description": "Allow or disallow duplicate object entry name.", + "default": true } } }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/JweDecrypt.json b/app/_schemas/ai-gateway/policies/JweDecrypt.json index 21fdcc00d5f..ae43a10eee3 100644 --- a/app/_schemas/ai-gateway/policies/JweDecrypt.json +++ b/app/_schemas/ai-gateway/policies/JweDecrypt.json @@ -13,6 +13,16 @@ "config": { "type": "object", "properties": { + "lookup_header_name": { + "type": "string", + "description": "The name of the header to look for the JWE token.", + "default": "Authorization" + }, + "forward_header_name": { + "type": "string", + "description": "The name of the header that is used to set the decrypted value.", + "default": "Authorization" + }, "key_sets": { "type": "array", "items": { @@ -24,16 +34,6 @@ "type": "boolean", "description": "Defines how the policy behaves in cases where no token was found in the request. When using `strict` mode, the request requires a token to be present and subsequently raise an error if none could be found.", "default": true - }, - "lookup_header_name": { - "type": "string", - "description": "The name of the header to look for the JWE token.", - "default": "Authorization" - }, - "forward_header_name": { - "type": "string", - "description": "The name of the header that is used to set the decrypted value.", - "default": "Authorization" } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/Jwt.json b/app/_schemas/ai-gateway/policies/Jwt.json index 6bb6fff5d1f..2a62c12426a 100644 --- a/app/_schemas/ai-gateway/policies/Jwt.json +++ b/app/_schemas/ai-gateway/policies/Jwt.json @@ -32,23 +32,22 @@ "config": { "type": "object", "properties": { + "run_on_preflight": { + "type": "boolean", + "description": "A boolean value that indicates whether the policy should run (and try to authenticate) on OPTIONS preflight requests. If set to false, then OPTIONS requests will always be allowed.", + "default": true + }, + "maximum_expiration": { + "type": "number", + "maximum": 31536000, + "minimum": 0, + "description": "A value between 0 and 31536000 (365 days) limiting the lifetime of the JWT to maximum_expiration seconds in the future.", + "default": 0 + }, "realm": { "type": "string", "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." }, - "cookie_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "A list of cookie names that Kong will inspect to retrieve JWTs.", - "default": [] - }, - "secret_is_base64": { - "type": "boolean", - "description": "If true, the policy assumes the credential’s secret to be base64 encoded. You will need to create a base64-encoded secret for your Consumer, and sign your JWT with the original secret.", - "default": false - }, "uri_param_names": { "type": "array", "items": { @@ -59,10 +58,10 @@ "jwt" ] }, - "key_claim_name": { - "type": "string", - "description": "The name of the claim in which the key identifying the secret must be passed. The policy will attempt to read this claim from the JWT payload and the header, in that order.", - "default": "iss" + "secret_is_base64": { + "type": "boolean", + "description": "If true, the policy assumes the credential’s secret to be base64 encoded. You will need to create a base64-encoded secret for your Consumer, and sign your JWT with the original secret.", + "default": false }, "claims_to_verify": { "type": "array", @@ -79,18 +78,6 @@ "type": "string", "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails." }, - "run_on_preflight": { - "type": "boolean", - "description": "A boolean value that indicates whether the policy should run (and try to authenticate) on OPTIONS preflight requests. If set to false, then OPTIONS requests will always be allowed.", - "default": true - }, - "maximum_expiration": { - "type": "number", - "maximum": 31536000, - "minimum": 0, - "description": "A value between 0 and 31536000 (365 days) limiting the lifetime of the JWT to maximum_expiration seconds in the future.", - "default": 0 - }, "header_names": { "type": "array", "items": { @@ -100,10 +87,23 @@ "default": [ "authorization" ] + }, + "cookie_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "A list of cookie names that Kong will inspect to retrieve JWTs.", + "default": [] + }, + "key_claim_name": { + "type": "string", + "description": "The name of the claim in which the key identifying the secret must be passed. The policy will attempt to read this claim from the JWT payload and the header, in that order.", + "default": "iss" } } }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -111,9 +111,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -121,7 +121,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/JwtSigner.json b/app/_schemas/ai-gateway/policies/JwtSigner.json index c9b216e9def..bdd7898a2e2 100644 --- a/app/_schemas/ai-gateway/policies/JwtSigner.json +++ b/app/_schemas/ai-gateway/policies/JwtSigner.json @@ -1,179 +1,150 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "model": { - "type": "object", - "properties": { - "id": { - "type": "string" - } - }, - "description": "Custom type for representing a foreign key with a null value allowed.", - "x-foreign": true - }, "config": { "type": "object", "properties": { - "trust_access_token_introspection": { - "type": "boolean", - "description": "Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to `true`, the expiry or scopes are not checked on a payload.", - "default": true + "access_token_leeway": { + "type": "number", + "description": "Adjusts clock skew between the token issuer and Kong. The value will be used to time-related claim verification. For example, it will be added to the token's `exp` claim before checking token expiry against Kong servers' current time in seconds. You can disable access token `expiry` verification altogether with `config.verify_access_token_expiry`.", + "default": 0 }, - "access_token_jwks_uri": { - "type": "string", - "description": "Specify the URI where the policy can fetch the public keys (JWKS) to verify the signature of the access token." + "access_token_introspection_scopes_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Specify the claim/property in access token introspection results (`JSON`) to be verified against values of `config.access_token_introspection_scopes_required`. This supports nested claims. For example, with Keycloak you could use `[ \"realm_access\", \"roles\" ]`, which can be given as `realm_access,roles` (form post). If the claim is not found in access token introspection results, and you have specified `config.access_token_introspection_scopes_required`, the policy responds with `403 Forbidden`.", + "default": [ + "scope" + ] }, - "access_token_jwks_uri_client_password": { - "type": "string", - "description": "The client password that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_username`", - "x-referenceable": true, - "x-encrypted": true + "access_token_introspection_issuer_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Specify the claim in an access token introspection to verify against values of `config.access_token_introspection_issuers_allowed`.", + "default": [ + "iss" + ] }, - "original_channel_token_upstream_header": { - "type": "string", - "description": "The HTTP header name used to store the original channel token." + "access_token_introspection_consumer_by": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "custom_id", + "id", + "username" + ] + }, + "description": "When the policy tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.", + "default": [ + "custom_id", + "username" + ] }, - "verify_channel_token_introspection_notbefore": { - "type": "boolean", - "description": "Quickly turn off and on the channel token introspection notbefore verification.", - "default": false + "channel_token_leeway": { + "type": "number", + "description": "Adjusts clock skew between the token issuer and Kong. The value will be used to time-related claim verification. For example, it will be added to token's `exp` claim before checking token expiry against Kong servers current time in seconds. You can disable channel token `expiry` verification altogether with `config.verify_channel_token_expiry`.", + "default": 0 }, - "channel_token_endpoints_ssl_verify": { - "type": "boolean", - "description": "Whether to verify the TLS certificate if any of `channel_token_introspection_endpoint`, `channel_token_jwks_uri`, or `channel_token_keyset` is an HTTPS URI.", - "default": true + "channel_token_introspection_consumer_by": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "custom_id", + "id", + "username" + ] + }, + "description": "When the policy tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are `id`, `username` and `custom_id`.", + "default": [ + "custom_id", + "username" + ] }, - "add_claims": { + "add_channel_token_claims": { "type": "object", "additionalProperties": { "type": "string" }, - "description": "Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", + "description": "Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", "default": {} }, - "access_token_introspection_leeway": { - "type": "number", - "description": "Adjusts clock skew between the token issuer introspection results and Kong. The value will be used to time-related claim verification. For example, it will be added to introspection results (`JSON`) `exp` claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection `expiry` verification altogether with `config.verify_access_token_introspection_expiry`.", - "default": 0 - }, - "verify_access_token_introspection_subject": { - "type": "boolean", - "description": "Quickly turn off and on the access token introspection required subjects verification, specified with `config.access_token_introspection_subjects_required`.", - "default": true - }, - "channel_token_required_claims": { + "access_token_introspection_notbefore_claim": { "type": "array", "items": { - "type": "array", - "items": { - "type": "string" - } + "type": "string" }, - "description": "Specify the required claims that must be present in the channel token. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + "description": "Specify the notbefore claim in an access token introspection to verify if the default `nbf` is not used.", + "default": [ + "nbf" + ] }, - "channel_token_introspection_subject_claim": { + "channel_token_audiences_allowed": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in a channel token to verify against values of `config.channel_token_introspection_subjects_allowed`.", - "default": [ - "sub" - ] + "description": "The audiences allowed to be present in the channel token claim specified by `config.channel_token_audience_claim`." }, - "channel_token_introspection_expiry_claim": { + "channel_token_notbefore_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the expiry claim in a channel token to verify if the default `exp` is not used.", + "description": "Specify the notbefore claim in a channel token to verify if the default `nbf` is not used.", "default": [ - "exp" + "nbf" ] }, - "channel_token_request_header": { - "type": "string", - "description": "This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to `null` or `\"\"` (empty string)." - }, - "channel_token_scopes_required": { + "channel_token_introspection_jwt_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the required values (or scopes) that are checked by a claim specified by `config.channel_token_scopes_claim`." - }, - "access_token_jwks_uri_rotate_period": { - "type": "number", - "description": "Specify the period (in seconds) to auto-rotate the jwks for `access_token_jwks_uri`. The default value 0 means no auto-rotation.", - "default": 0 - }, - "access_token_keyset_client_username": { - "type": "string", - "description": "The client username that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_password`", - "x-referenceable": true + "description": "If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (`JSON`), the policy can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong." }, - "access_token_introspection_subjects_allowed": { + "channel_token_introspection_issuer_claim": { "type": "array", "items": { "type": "string" }, - "description": "The subjects allowed to be present in the access token introspection claim specified by `config.access_token_introspection_subject_claim`." + "description": "Specify the claim in a channel token introspection to verify against values of `config.channel_token_introspection_issuers_allowed`.", + "default": [ + "iss" + ] }, - "channel_token_upstream_leeway": { - "type": "number", - "description": "If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's `exp` claim.", - "default": 0 + "channel_token_introspection_consumer_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter (such as `sub` or `username`) in channel token introspection results to Kong consumer entity" }, - "verify_access_token_audience": { + "verify_channel_token_notbefore": { "type": "boolean", - "description": "Quickly turn off and on the access token required audiences verification, specified with `config.access_token_audiences_required`.", - "default": true + "description": "Quickly turn off and on the channel token notbefore verification.", + "default": false }, - "channel_token_introspection_scopes_required": { + "access_token_introspection_audience_claim": { "type": "array", "items": { "type": "string" }, - "description": "Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by `config.channel_token_introspection_scopes_claim`." + "description": "Specify the claim in an access token introspection to verify against values of `config.access_token_introspection_audiences_allowed`.", + "default": [ + "aud" + ] }, - "channel_token_signing_algorithm": { - "type": "string", - "enum": [ - "ES256", - "ES384", - "ES512", - "EdDSA", - "HS256", - "HS384", - "HS512", - "PS256", - "PS384", - "PS512", - "RS256", - "RS512" - ], - "description": "When this policy sets the upstream header as specified with `config.channel_token_upstream_header`, it also re-signs the original channel token using private keys of this policy. Specify the algorithm that is used to sign the token.", - "default": "RS256" + "verify_access_token_notbefore": { + "type": "boolean", + "description": "Quickly turn off and on the access token notbefore verification.", + "default": false }, - "access_token_introspection_required_claims": { + "channel_token_optional_claims": { "type": "array", "items": { "type": "array", @@ -181,62 +152,24 @@ "type": "string" } }, - "description": "Specify the required claims that must be present in the access token introspection result. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." - }, - "enable_access_token_introspection": { - "type": "boolean", - "description": "If you don't want to support opaque access tokens, change this configuration parameter to `false` to disable introspection.", - "default": true + "description": "Specify the optional claims of the channel token. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." }, - "access_token_scopes_claim": { + "channel_token_issuer_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in an access token to verify against values of `config.access_token_scopes_required`.", + "description": "Specify the claim in a channel token to verify against values of `config.channel_token_issuers_allowed`.", "default": [ - "scope" + "iss" ] }, - "access_token_introspection_hint": { - "type": "string", - "description": "If you need to give `hint` parameter when introspecting an access token, use this parameter to specify the value. By default, the policy sends `hint=access_token`.", - "default": "access_token" - }, - "access_token_introspection_scopes_required": { + "access_token_subjects_allowed": { "type": "array", "items": { "type": "string" }, - "description": "Specify the required values (or scopes) that are checked by an introspection claim/property specified by `config.access_token_introspection_scopes_claim`." - }, - "channel_token_introspection_endpoint": { - "type": "string", - "description": "When you use `opaque` access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the policy does not try introspection and returns `401 Unauthorized` instead." - }, - "cache_channel_token_introspection": { - "type": "boolean", - "description": "Whether to cache channel token introspection results.", - "default": true - }, - "realm": { - "type": "string", - "description": "When authentication or authorization fails, or there is an unexpected error, the policy sends a `WWW-Authenticate` header with the `realm` attribute value." - }, - "access_token_keyset_client_certificate": { - "type": "object", - "properties": { - "id": { - "type": "string" - } - }, - "description": "The client certificate that will be used to authenticate Kong if `access_token_keyset` is an https uri that requires mTLS Auth.", - "x-foreign": true - }, - "access_token_request_header": { - "type": "string", - "description": "This parameter tells the name of the header where to look for the access token.", - "default": "Authorization" + "description": "The subjects allowed to be present in the access token claim specified by `config.access_token_subject_claim`." }, "access_token_audiences_allowed": { "type": "array", @@ -245,76 +178,45 @@ }, "description": "The audiences allowed to be present in the access token claim specified by `config.access_token_audience_claim`." }, - "access_token_upstream_leeway": { - "type": "number", - "description": "If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's `exp` claim.", - "default": 0 - }, - "verify_access_token_introspection_scopes": { - "type": "boolean", - "description": "Quickly turn off and on the access token introspection scopes verification, specified with `config.access_token_introspection_scopes_required`.", - "default": true - }, - "access_token_consumer_by": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "custom_id", - "id", - "username" - ] - }, - "description": "When the policy tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are `id`, `username`, and `custom_id`.", - "default": [ - "custom_id", - "username" - ] - }, - "channel_token_keyset_client_certificate": { - "type": "object", - "properties": { - "id": { - "type": "string" - } + "access_token_issuers_allowed": { + "type": "array", + "items": { + "type": "string" }, - "description": "The client certificate that will be used to authenticate Kong if `channel_token_keyset` is an https uri that requires mTLS Auth.", - "x-foreign": true + "description": "The issuers allowed to be present in the access token claim specified by `config.access_token_issuer_claim`." }, - "channel_token_introspection_consumer_by": { + "access_token_issuer_claim": { "type": "array", "items": { - "type": "string", - "enum": [ - "custom_id", - "id", - "username" - ] + "type": "string" }, - "description": "When the policy tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are `id`, `username` and `custom_id`.", + "description": "Specify the claim in an access token to verify against values of `config.access_token_issuers_allowed`.", "default": [ - "custom_id", - "username" + "iss" ] }, - "access_token_leeway": { - "type": "number", - "description": "Adjusts clock skew between the token issuer and Kong. The value will be used to time-related claim verification. For example, it will be added to the token's `exp` claim before checking token expiry against Kong servers' current time in seconds. You can disable access token `expiry` verification altogether with `config.verify_access_token_expiry`.", - "default": 0 + "access_token_introspection_authorization": { + "type": "string", + "description": "If the introspection endpoint requires client authentication (client being the JWT Signer policy), you can specify the `Authorization` header's value with this configuration parameter." }, - "access_token_scopes_required": { + "verify_access_token_introspection_subject": { + "type": "boolean", + "description": "Quickly turn off and on the access token introspection required subjects verification, specified with `config.access_token_introspection_subjects_required`.", + "default": true + }, + "verify_channel_token_issuer": { + "type": "boolean", + "description": "Quickly turn off and on the channel token allowed issuers verification, specified with `config.channel_token_issuers_allowed`.", + "default": true + }, + "access_token_consumer_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the required values (or scopes) that are checked by a claim specified by `config.access_token_scopes_claim`." - }, - "access_token_signing": { - "type": "boolean", - "description": "Quickly turn access token signing or re-signing off and on as needed. If turned off, the policy will not send the signed or resigned token to the upstream.", - "default": true + "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter (for example, `sub` or `username`) in an access token to Kong consumer entity." }, - "access_token_introspection_consumer_by": { + "access_token_consumer_by": { "type": "array", "items": { "type": "string", @@ -324,197 +226,187 @@ "username" ] }, - "description": "When the policy tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.", + "description": "When the policy tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are `id`, `username`, and `custom_id`.", "default": [ "custom_id", "username" ] }, - "channel_token_issuer": { - "type": "string", - "description": "The `iss` claim of the re-signed channel token is set to this value, which is `kong` by default. The original `iss` claim of the incoming token (possibly introspected) is stored in the `original_iss` claim of the newly signed channel token.", - "default": "kong" - }, - "channel_token_keyset_rotate_period": { + "access_token_upstream_leeway": { "type": "number", - "description": "Specify the period (in seconds) to auto-rotate the jwks for `channel_token_keyset`. The default value 0 means no auto-rotation.", + "description": "If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's `exp` claim.", "default": 0 }, - "remove_channel_token_claims": { - "type": "array", - "items": { - "type": "string" - }, - "description": "remove claims. It should be an array, and each element is a claim key string.", - "default": [] + "verify_access_token_issuer": { + "type": "boolean", + "description": "Quickly turn off and on the access token allowed issuers verification, specified with `config.access_token_issuers_allowed`.", + "default": true + }, + "channel_token_introspection_authorization": { + "type": "string", + "description": "When using `opaque` channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the policy will not try introspection, and instead returns `401 Unauthorized` when using opaque channel tokens." }, "verify_channel_token_signature": { "type": "boolean", "description": "Quickly turn on/off the channel token signature verification.", "default": true }, - "access_token_introspection_issuers_allowed": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The issuers allowed to be present in the access token introspection claim specified by `config.access_token_introspection_issuer_claim`." + "verify_channel_token_introspection_notbefore": { + "type": "boolean", + "description": "Quickly turn off and on the channel token introspection notbefore verification.", + "default": false }, - "access_token_introspection_expiry_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Specify the expiry claim in an access token introspection to verify if the default `exp` is not used.", - "default": [ - "exp" - ] + "access_token_introspection_endpoint": { + "type": "string", + "description": "When you use `opaque` access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter." }, - "verify_access_token_introspection_expiry": { + "verify_access_token_introspection_scopes": { "type": "boolean", - "description": "Quickly turn access token introspection expiry verification off and on as needed.", + "description": "Quickly turn off and on the access token introspection scopes verification, specified with `config.access_token_introspection_scopes_required`.", "default": true }, - "channel_token_jwks_uri_client_certificate": { - "type": "object", - "properties": { - "id": { - "type": "string" - } - }, - "description": "The client certificate that will be used to authenticate Kong if `channel_token_jwks_uri` is an https uri that requires mTLS Auth.", - "x-foreign": true + "enable_access_token_introspection": { + "type": "boolean", + "description": "If you don't want to support opaque access tokens, change this configuration parameter to `false` to disable introspection.", + "default": true }, - "channel_token_audience_claim": { + "channel_token_keyset_client_password": { + "type": "string", + "description": "The client password that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_username`", + "x-referenceable": true, + "x-encrypted": true + }, + "channel_token_subject_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in a channel token to verify against values of `config.channel_token_audiences_allowed`.", + "description": "Specify the claim in a channel token to verify against values of `config.channel_token_subjects_allowed`.", "default": [ - "aud" + "sub" ] }, - "verify_channel_token_issuer": { + "channel_token_signing": { "type": "boolean", - "description": "Quickly turn off and on the channel token allowed issuers verification, specified with `config.channel_token_issuers_allowed`.", + "description": "Quickly turn channel token signing or re-signing off and on as needed. If turned off, the policy will not send the signed or resigned token to the upstream.", "default": true }, - "channel_token_notbefore_claim": { + "channel_token_introspection_subject_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the notbefore claim in a channel token to verify if the default `nbf` is not used.", + "description": "Specify the claim in a channel token to verify against values of `config.channel_token_introspection_subjects_allowed`.", "default": [ - "nbf" + "sub" ] }, - "add_channel_token_claims": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", - "default": {} - }, - "access_token_introspection_optional_claims": { - "type": "array", - "items": { - "type": "array", - "items": { - "type": "string" - } - }, - "description": "Specify the optional claims of the access token introspection result. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + "access_token_signing": { + "type": "boolean", + "description": "Quickly turn access token signing or re-signing off and on as needed. If turned off, the policy will not send the signed or resigned token to the upstream.", + "default": true }, - "remove_access_token_claims": { + "access_token_introspection_scopes_required": { "type": "array", "items": { "type": "string" }, - "description": "remove claims. It should be an array, and each element is a claim key string.", - "default": [] + "description": "Specify the required values (or scopes) that are checked by an introspection claim/property specified by `config.access_token_introspection_scopes_claim`." }, - "verify_access_token_subject": { - "type": "boolean", - "description": "Quickly turn off and on the access token required subjects verification, specified with `config.access_token_subjects_required`.", - "default": true + "channel_token_keyset_rotate_period": { + "type": "number", + "description": "Specify the period (in seconds) to auto-rotate the jwks for `channel_token_keyset`. The default value 0 means no auto-rotation.", + "default": 0 }, - "channel_token_optional_claims": { + "channel_token_subjects_allowed": { "type": "array", "items": { - "type": "array", - "items": { - "type": "string" - } + "type": "string" }, - "description": "Specify the optional claims of the channel token. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + "description": "The subjects allowed to be present in the channel token claim specified by `config.channel_token_subject_claim`." }, - "channel_token_issuer_claim": { + "channel_token_consumer_by": { "type": "array", "items": { - "type": "string" + "type": "string", + "enum": [ + "custom_id", + "id", + "username" + ] }, - "description": "Specify the claim in a channel token to verify against values of `config.channel_token_issuers_allowed`.", + "description": "When the policy tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: `id`, `username`, and `custom_id`.", "default": [ - "iss" + "custom_id", + "username" ] }, - "verify_access_token_introspection_audience": { + "verify_channel_token_introspection_expiry": { "type": "boolean", - "description": "Quickly turn off and on the access token introspection required audiences verification, specified with `config.access_token_introspection_audiences_required`.", + "description": "Quickly turn on/off the channel token introspection expiry verification.", "default": true }, - "channel_token_jwks_uri_rotate_period": { - "type": "number", - "description": "Specify the period (in seconds) to auto-rotate the jwks for `channel_token_jwks_uri`. The default value 0 means no auto-rotation.", - "default": 0 - }, - "channel_token_introspection_optional_claims": { + "access_token_introspection_jwt_claim": { "type": "array", "items": { - "type": "array", - "items": { - "type": "string" - } + "type": "string" }, - "description": "Specify the optional claims of the channel token introspection. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + "description": "If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (`JSON`). If the key cannot be found, the policy responds with `401 Unauthorized`. Also if the key is found but cannot be decoded as JWT, it also responds with `401 Unauthorized`." }, - "access_token_issuer_claim": { + "access_token_introspection_subject_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in an access token to verify against values of `config.access_token_issuers_allowed`.", + "description": "Specify the claim in an access token introspection to verify against values of `config.access_token_introspection_subjects_allowed`.", "default": [ - "iss" + "sub" ] }, - "access_token_introspection_consumer_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter (such as `sub` or `username`) in access token introspection results to the Kong consumer entity." + "access_token_signing_algorithm": { + "type": "string", + "enum": [ + "ES256", + "ES384", + "ES512", + "EdDSA", + "HS256", + "HS384", + "HS512", + "PS256", + "PS384", + "PS512", + "RS256", + "RS512" + ], + "description": "When this policy sets the upstream header as specified with `config.access_token_upstream_header`, re-signs the original access token using the private keys of the JWT Signer policy. Specify the algorithm that is used to sign the token. The `config.access_token_issuer` specifies which `keyset` is used to sign the new token issued by Kong using the specified signing algorithm.", + "default": "RS256" }, - "access_token_introspection_audience_claim": { + "channel_token_introspection_audience_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in an access token introspection to verify against values of `config.access_token_introspection_audiences_allowed`.", + "description": "Specify the claim in a channel token introspection to verify against values of `config.channel_token_introspection_audiences_allowed`.", "default": [ "aud" ] }, - "channel_token_jwks_uri_client_password": { + "access_token_keyset_client_certificate": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "The client certificate that will be used to authenticate Kong if `access_token_keyset` is an https uri that requires mTLS Auth.", + "x-foreign": true + }, + "access_token_introspection_body_args": { "type": "string", - "description": "The client password that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_username`", - "x-referenceable": true, - "x-encrypted": true + "description": "This parameter allows you to pass URL encoded request body arguments. For example: `resource=` or `a=1&b=&c`." }, - "set_channel_token_claims": { + "set_access_token_claims": { "type": "object", "additionalProperties": { "type": "string" @@ -522,210 +414,270 @@ "description": "Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", "default": {} }, - "verify_channel_token_subject": { - "type": "boolean", - "description": "Quickly turn off and on the channel token required subjects verification, specified with `config.channel_token_subjects_required`.", - "default": true + "channel_token_introspection_optional_claims": { + "type": "array", + "items": { + "type": "array", + "items": { + "type": "string" + } + }, + "description": "Specify the optional claims of the channel token introspection. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." }, - "verify_channel_token_introspection_scopes": { - "type": "boolean", - "description": "Quickly turn on/off the channel token introspection scopes verification specified with `config.channel_token_introspection_scopes_required`.", - "default": true + "access_token_keyset_rotate_period": { + "type": "number", + "description": "Specify the period (in seconds) to auto-rotate the jwks for `access_token_keyset`. The default value 0 means no auto-rotation.", + "default": 0 }, - "access_token_jwks_uri_client_certificate": { + "access_token_request_header": { + "type": "string", + "description": "This parameter tells the name of the header where to look for the access token.", + "default": "Authorization" + }, + "access_token_introspection_hint": { + "type": "string", + "description": "If you need to give `hint` parameter when introspecting an access token, use this parameter to specify the value. By default, the policy sends `hint=access_token`.", + "default": "access_token" + }, + "channel_token_keyset_client_certificate": { "type": "object", "properties": { "id": { "type": "string" } }, - "description": "The client certificate that will be used to authenticate Kong if `access_token_jwks_uri` is an https uri that requires mTLS Auth.", + "description": "The client certificate that will be used to authenticate Kong if `channel_token_keyset` is an https uri that requires mTLS Auth.", "x-foreign": true }, - "access_token_required_claims": { - "type": "array", - "items": { - "type": "array", - "items": { - "type": "string" - } - }, - "description": "Specify the required claims that must be present in the access token. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + "channel_token_introspection_timeout": { + "type": "number", + "description": "Timeout in milliseconds for an introspection request. The policy tries to introspect twice if the first request fails for some reason. If both requests timeout, then the policy runs two times the `config.access_token_introspection_timeout` on channel token introspection." }, - "access_token_endpoints_ssl_verify": { + "channel_token_endpoints_ssl_verify": { "type": "boolean", - "description": "Whether to verify the TLS certificate if any of `access_token_introspection_endpoint`, `access_token_jwks_uri`, or `access_token_keyset` is an HTTPS URI.", + "description": "Whether to verify the TLS certificate if any of `channel_token_introspection_endpoint`, `channel_token_jwks_uri`, or `channel_token_keyset` is an HTTPS URI.", "default": true }, - "channel_token_leeway": { + "access_token_jwks_uri": { + "type": "string", + "description": "Specify the URI where the policy can fetch the public keys (JWKS) to verify the signature of the access token." + }, + "access_token_jwks_uri_rotate_period": { "type": "number", - "description": "Adjusts clock skew between the token issuer and Kong. The value will be used to time-related claim verification. For example, it will be added to token's `exp` claim before checking token expiry against Kong servers current time in seconds. You can disable channel token `expiry` verification altogether with `config.verify_channel_token_expiry`.", + "description": "Specify the period (in seconds) to auto-rotate the jwks for `access_token_jwks_uri`. The default value 0 means no auto-rotation.", "default": 0 }, - "channel_token_expiry_claim": { + "channel_token_keyset_client_username": { + "type": "string", + "description": "The client username that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_password`", + "x-referenceable": true + }, + "channel_token_scopes_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the expiry claim in a channel token to verify if the default `exp` is not used.", + "description": "Specify the claim in a channel token to verify against values of `config.channel_token_scopes_required`. This supports nested claims.", "default": [ - "exp" + "scope" ] }, - "channel_token_consumer_by": { + "channel_token_introspection_scopes_claim": { "type": "array", "items": { - "type": "string", - "enum": [ - "custom_id", - "id", - "username" - ] + "type": "string" }, - "description": "When the policy tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: `id`, `username`, and `custom_id`.", + "description": "Use this parameter to specify the claim/property in channel token introspection results (`JSON`) to be verified against values of `config.channel_token_introspection_scopes_required`. This supports nested claims.", "default": [ - "custom_id", - "username" + "scope" ] }, - "channel_token_introspection_body_args": { - "type": "string", - "description": "If you need to pass additional body arguments to introspection endpoint when the policy introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: `resource=` or `a=1&b=&c`." + "verify_channel_token_expiry": { + "type": "boolean", + "default": true }, - "access_token_introspection_jwt_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (`JSON`). If the key cannot be found, the policy responds with `401 Unauthorized`. Also if the key is found but cannot be decoded as JWT, it also responds with `401 Unauthorized`." + "access_token_introspection_leeway": { + "type": "number", + "description": "Adjusts clock skew between the token issuer introspection results and Kong. The value will be used to time-related claim verification. For example, it will be added to introspection results (`JSON`) `exp` claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection `expiry` verification altogether with `config.verify_access_token_introspection_expiry`.", + "default": 0 }, - "verify_access_token_notbefore": { + "enable_instrumentation": { "type": "boolean", - "description": "Quickly turn off and on the access token notbefore verification.", + "description": "Writes log entries with some added information using `ngx.CRIT` (CRITICAL) level.", "default": false }, - "channel_token_jwks_uri_client_username": { + "access_token_jwks_uri_client_username": { "type": "string", - "description": "The client username that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_password`", + "description": "The client username that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_password`", "x-referenceable": true }, - "channel_token_subject_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Specify the claim in a channel token to verify against values of `config.channel_token_subjects_allowed`.", - "default": [ - "sub" - ] - }, - "verify_channel_token_notbefore": { + "verify_access_token_introspection_issuer": { "type": "boolean", - "description": "Quickly turn off and on the channel token notbefore verification.", - "default": false + "description": "Quickly turn off and on the access token introspection allowed issuers verification, specified with `config.access_token_introspection_issuers_allowed`.", + "default": true }, - "verify_channel_token_introspection_audience": { + "access_token_endpoints_ssl_verify": { "type": "boolean", - "description": "Quickly turn off and on the channel token introspection required audiences verification, specified with `config.channel_token_introspection_audiences_required`.", + "description": "Whether to verify the TLS certificate if any of `access_token_introspection_endpoint`, `access_token_jwks_uri`, or `access_token_keyset` is an HTTPS URI.", "default": true }, - "access_token_keyset_client_password": { - "type": "string", - "description": "The client password that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_username`", - "x-referenceable": true, - "x-encrypted": true + "set_claims": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", + "default": {} }, - "access_token_audience_claim": { + "enable_hs_signatures": { + "type": "boolean", + "description": "Tokens signed with HMAC algorithms such as `HS256`, `HS384`, or `HS512` are not accepted by default. If you need to accept such tokens for verification, enable this setting.", + "default": false + }, + "access_token_scopes_required": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in an access token to verify against values of `config.access_token_audiences_allowed`.", - "default": [ - "aud" - ] + "description": "Specify the required values (or scopes) that are checked by a claim specified by `config.access_token_scopes_claim`." }, - "access_token_introspection_issuer_claim": { + "access_token_introspection_subjects_allowed": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in an access token introspection to verify against values of `config.access_token_introspection_issuers_allowed`.", - "default": [ - "iss" - ] + "description": "The subjects allowed to be present in the access token introspection claim specified by `config.access_token_introspection_subject_claim`." }, - "access_token_introspection_subject_claim": { + "channel_token_expiry_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in an access token introspection to verify against values of `config.access_token_introspection_subjects_allowed`.", + "description": "Specify the expiry claim in a channel token to verify if the default `exp` is not used.", "default": [ - "sub" + "exp" ] }, - "access_token_introspection_notbefore_claim": { + "access_token_jwks_uri_client_certificate": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "The client certificate that will be used to authenticate Kong if `access_token_jwks_uri` is an https uri that requires mTLS Auth.", + "x-foreign": true + }, + "original_access_token_upstream_header": { + "type": "string", + "description": "The HTTP header name used to store the original access token." + }, + "channel_token_jwks_uri_client_certificate": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "The client certificate that will be used to authenticate Kong if `channel_token_jwks_uri` is an https uri that requires mTLS Auth.", + "x-foreign": true + }, + "channel_token_upstream_header": { + "type": "string", + "description": "This policy removes the `config.channel_token_request_header` from the request after reading its value." + }, + "verify_channel_token_introspection_audience": { + "type": "boolean", + "description": "Quickly turn off and on the channel token introspection required audiences verification, specified with `config.channel_token_introspection_audiences_required`.", + "default": true + }, + "access_token_notbefore_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the notbefore claim in an access token introspection to verify if the default `nbf` is not used.", + "description": "Specify the notbefore claim in an access token to verify if the default `nbf` is not used.", "default": [ "nbf" ] }, - "verify_access_token_introspection_issuer": { - "type": "boolean", - "description": "Quickly turn off and on the access token introspection allowed issuers verification, specified with `config.access_token_introspection_issuers_allowed`.", - "default": true - }, - "channel_token_keyset_client_password": { - "type": "string", - "description": "The client password that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_username`", - "x-referenceable": true, - "x-encrypted": true + "channel_token_issuers_allowed": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The issuers allowed to be present in the channel token claim specified by `config.channel_token_issuer_claim`." }, - "channel_token_jwks_uri": { + "channel_token_signing_algorithm": { "type": "string", - "description": "If you want to use `config.verify_channel_token_signature`, you must specify the URI where the policy can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the policy, then the policy responds with `401 Unauthorized`." + "enum": [ + "ES256", + "ES384", + "ES512", + "EdDSA", + "HS256", + "HS384", + "HS512", + "PS256", + "PS384", + "PS512", + "RS256", + "RS512" + ], + "description": "When this policy sets the upstream header as specified with `config.channel_token_upstream_header`, it also re-signs the original channel token using private keys of this policy. Specify the algorithm that is used to sign the token.", + "default": "RS256" }, - "channel_token_audiences_allowed": { + "access_token_optional_claims": { "type": "array", "items": { - "type": "string" + "type": "array", + "items": { + "type": "string" + } }, - "description": "The audiences allowed to be present in the channel token claim specified by `config.channel_token_audience_claim`." + "description": "Specify the optional claims of the access token. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + }, + "verify_access_token_signature": { + "type": "boolean", + "description": "Quickly turn access token signature verification off and on as needed.", + "default": true }, - "channel_token_introspection_jwt_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (`JSON`), the policy can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong." + "channel_token_keyset": { + "type": "string", + "description": "The name of the keyset containing signing keys.", + "default": "kong" }, - "access_token_jwks_uri_client_username": { + "channel_token_jwks_uri_client_username": { "type": "string", - "description": "The client username that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_password`", + "description": "The client username that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_password`", "x-referenceable": true }, - "access_token_introspection_endpoint": { + "channel_token_jwks_uri_client_password": { "type": "string", - "description": "When you use `opaque` access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter." + "description": "The client password that will be used to authenticate Kong if `channel_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `channel_token_jwks_uri_client_username`", + "x-referenceable": true, + "x-encrypted": true }, - "access_token_introspection_audiences_allowed": { + "channel_token_audience_claim": { "type": "array", "items": { "type": "string" }, - "description": "The audiences allowed to be present in the access token introspection claim specified by `config.access_token_introspection_audience_claim`." + "description": "Specify the claim in a channel token to verify against values of `config.channel_token_audiences_allowed`.", + "default": [ + "aud" + ] }, - "verify_access_token_expiry": { - "type": "boolean", - "description": "Quickly turn access token expiry verification off and on as needed.", - "default": true + "channel_token_upstream_leeway": { + "type": "number", + "description": "If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's `exp` claim.", + "default": 0 }, - "channel_token_introspection_required_claims": { + "channel_token_introspection_endpoint": { + "type": "string", + "description": "When you use `opaque` access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the policy does not try introspection and returns `401 Unauthorized` instead." + }, + "access_token_introspection_required_claims": { "type": "array", "items": { "type": "array", @@ -733,14 +685,30 @@ "type": "string" } }, - "description": "Specify the required claims that must be present in the channel token introspection. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + "description": "Specify the required claims that must be present in the access token introspection result. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." }, - "channel_token_introspection_audiences_allowed": { + "set_channel_token_claims": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", + "default": {} + }, + "channel_token_optional": { + "type": "boolean", + "description": "If a channel token is not provided or no `config.channel_token_request_header` is specified, the policy cannot verify the channel token. In that case, the policy normally responds with `401 Unauthorized` (client didn't send a token) or `500 Unexpected` (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect", + "default": false + }, + "access_token_subject_claim": { "type": "array", "items": { "type": "string" }, - "description": "The audiences allowed to be present in the channel token introspection claim specified by `config.channel_token_introspection_audience_claim`." + "description": "Specify the claim in an access token to verify against values of `config.access_token_subjects_allowed`.", + "default": [ + "sub" + ] }, "access_token_expiry_claim": { "type": "array", @@ -752,360 +720,392 @@ "exp" ] }, - "enable_hs_signatures": { - "type": "boolean", - "description": "Tokens signed with HMAC algorithms such as `HS256`, `HS384`, or `HS512` are not accepted by default. If you need to accept such tokens for verification, enable this setting.", - "default": false - }, - "access_token_keyset_rotate_period": { - "type": "number", - "description": "Specify the period (in seconds) to auto-rotate the jwks for `access_token_keyset`. The default value 0 means no auto-rotation.", - "default": 0 - }, - "add_access_token_claims": { - "type": "object", - "additionalProperties": { + "access_token_introspection_audiences_allowed": { + "type": "array", + "items": { "type": "string" }, - "description": "Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", - "default": {} + "description": "The audiences allowed to be present in the access token introspection claim specified by `config.access_token_introspection_audience_claim`." }, - "verify_access_token_scopes": { + "verify_access_token_expiry": { "type": "boolean", - "description": "Quickly turn off and on the access token required scopes verification, specified with `config.access_token_scopes_required`.", + "description": "Quickly turn access token expiry verification off and on as needed.", "default": true }, - "verify_access_token_issuer": { + "verify_access_token_audience": { "type": "boolean", - "description": "Quickly turn off and on the access token allowed issuers verification, specified with `config.access_token_issuers_allowed`.", + "description": "Quickly turn off and on the access token required audiences verification, specified with `config.access_token_audiences_required`.", "default": true }, - "verify_channel_token_scopes": { + "channel_token_jwks_uri_rotate_period": { + "type": "number", + "description": "Specify the period (in seconds) to auto-rotate the jwks for `channel_token_jwks_uri`. The default value 0 means no auto-rotation.", + "default": 0 + }, + "verify_channel_token_introspection_subject": { "type": "boolean", - "description": "Quickly turn on/off the channel token required scopes verification specified with `config.channel_token_scopes_required`.", + "description": "Quickly turn off and on the channel token introspection required subjects verification, specified with `config.channel_token_introspection_subjects_required`.", "default": true }, - "access_token_optional_claims": { - "type": "array", - "items": { - "type": "array", - "items": { - "type": "string" - } - }, - "description": "Specify the optional claims of the access token. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." - }, - "access_token_optional": { + "trust_channel_token_introspection": { "type": "boolean", - "description": "If an access token is not provided or no `config.access_token_request_header` is specified, the policy cannot verify the access token. In that case, the policy normally responds with `401 Unauthorized` (client didn't send a token) or `500 Unexpected` (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect", - "default": false + "description": "Providing an opaque channel token for policy introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the policy signs a new token. This also applies when using a JWT token with introspection JSON as per config.channel_token_introspection_jwt_claim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.", + "default": true }, - "channel_token_scopes_claim": { + "access_token_scopes_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in a channel token to verify against values of `config.channel_token_scopes_required`. This supports nested claims.", + "description": "Specify the claim in an access token to verify against values of `config.access_token_scopes_required`.", "default": [ "scope" ] }, - "channel_token_introspection_subjects_allowed": { + "channel_token_scopes_required": { "type": "array", "items": { "type": "string" }, - "description": "The subjects allowed to be present in the channel token introspection claim specified by `config.channel_token_introspection_subject_claim`." + "description": "Specify the required values (or scopes) that are checked by a claim specified by `config.channel_token_scopes_claim`." }, - "channel_token_introspection_timeout": { - "type": "number", - "description": "Timeout in milliseconds for an introspection request. The policy tries to introspect twice if the first request fails for some reason. If both requests timeout, then the policy runs two times the `config.access_token_introspection_timeout` on channel token introspection." + "access_token_issuer": { + "type": "string", + "description": "The `iss` claim of a signed or re-signed access token is set to this value. Original `iss` claim of the incoming token (possibly introspected) is stored in `original_iss` claim of the newly signed access token.", + "default": "kong" }, - "verify_channel_token_audience": { + "verify_access_token_introspection_expiry": { "type": "boolean", - "description": "Quickly turn off and on the channel token required audiences verification, specified with `config.channel_token_audiences_required`.", + "description": "Quickly turn access token introspection expiry verification off and on as needed.", "default": true }, - "set_claims": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", - "default": {} - }, - "access_token_introspection_body_args": { - "type": "string", - "description": "This parameter allows you to pass URL encoded request body arguments. For example: `resource=` or `a=1&b=&c`." - }, - "verify_channel_token_expiry": { + "cache_access_token_introspection": { "type": "boolean", + "description": "Whether to cache access token introspection results.", "default": true }, - "access_token_issuers_allowed": { + "realm": { + "type": "string", + "description": "When authentication or authorization fails, or there is an unexpected error, the policy sends a `WWW-Authenticate` header with the `realm` attribute value." + }, + "channel_token_introspection_expiry_claim": { "type": "array", "items": { "type": "string" }, - "description": "The issuers allowed to be present in the access token claim specified by `config.access_token_issuer_claim`." + "description": "Specify the expiry claim in a channel token to verify if the default `exp` is not used.", + "default": [ + "exp" + ] }, - "original_access_token_upstream_header": { + "original_channel_token_upstream_header": { "type": "string", - "description": "The HTTP header name used to store the original access token." + "description": "The HTTP header name used to store the original channel token." }, - "channel_token_signing": { + "verify_channel_token_introspection_issuer": { "type": "boolean", - "description": "Quickly turn channel token signing or re-signing off and on as needed. If turned off, the policy will not send the signed or resigned token to the upstream.", + "description": "Quickly turn off and on the channel token introspection allowed issuers verification, specified with `config.channel_token_introspection_issuers_allowed`.", "default": true }, - "verify_channel_token_introspection_expiry": { + "access_token_keyset_client_username": { + "type": "string", + "description": "The client username that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_password`", + "x-referenceable": true + }, + "access_token_upstream_header": { + "type": "string", + "description": "Removes the `config.access_token_request_header` from the request after reading its value. With `config.access_token_upstream_header`, you can specify the upstream header where the policy adds the Kong signed token. If you don't specify a value, such as use `null` or `\"\"` (empty string), the policy does not even try to sign or re-sign the token.", + "default": "Authorization:Bearer" + }, + "channel_token_request_header": { + "type": "string", + "description": "This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to `null` or `\"\"` (empty string)." + }, + "cache_channel_token_introspection": { "type": "boolean", - "description": "Quickly turn on/off the channel token introspection expiry verification.", + "description": "Whether to cache channel token introspection results.", "default": true }, - "verify_channel_token_introspection_issuer": { + "verify_access_token_subject": { "type": "boolean", - "description": "Quickly turn off and on the channel token introspection allowed issuers verification, specified with `config.channel_token_introspection_issuers_allowed`.", + "description": "Quickly turn off and on the access token required subjects verification, specified with `config.access_token_subjects_required`.", "default": true }, - "access_token_keyset": { + "channel_token_introspection_hint": { "type": "string", - "description": "The name of the keyset containing signing keys.", - "default": "kong" + "description": "If you need to give `hint` parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a `hint` isn't sent with channel token introspection." }, - "set_access_token_claims": { + "add_access_token_claims": { "type": "object", "additionalProperties": { "type": "string" }, - "description": "Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", + "description": "Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", "default": {} }, - "channel_token_keyset_client_username": { + "verify_access_token_introspection_audience": { + "type": "boolean", + "description": "Quickly turn off and on the access token introspection required audiences verification, specified with `config.access_token_introspection_audiences_required`.", + "default": true + }, + "channel_token_introspection_scopes_required": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by `config.channel_token_introspection_scopes_claim`." + }, + "channel_token_introspection_audiences_allowed": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The audiences allowed to be present in the channel token introspection claim specified by `config.channel_token_introspection_audience_claim`." + }, + "verify_channel_token_subject": { + "type": "boolean", + "description": "Quickly turn off and on the channel token required subjects verification, specified with `config.channel_token_subjects_required`.", + "default": true + }, + "access_token_keyset": { "type": "string", - "description": "The client username that will be used to authenticate Kong if `channel_token_keyset` is a uri that requires Basic Auth. Should be configured together with `channel_token_keyset_client_password`", - "x-referenceable": true + "description": "The name of the keyset containing signing keys.", + "default": "kong" }, "access_token_introspection_timeout": { "type": "number", "description": "Timeout in milliseconds for an introspection request. The policy tries to introspect twice if the first request fails for some reason. If both requests timeout, then the policy runs two times the `config.access_token_introspection_timeout` on access token introspection." }, - "cache_access_token_introspection": { - "type": "boolean", - "description": "Whether to cache access token introspection results.", - "default": true + "channel_token_issuer": { + "type": "string", + "description": "The `iss` claim of the re-signed channel token is set to this value, which is `kong` by default. The original `iss` claim of the incoming token (possibly introspected) is stored in the `original_iss` claim of the newly signed channel token.", + "default": "kong" }, - "channel_token_introspection_scopes_claim": { + "channel_token_introspection_subjects_allowed": { "type": "array", "items": { "type": "string" }, - "description": "Use this parameter to specify the claim/property in channel token introspection results (`JSON`) to be verified against values of `config.channel_token_introspection_scopes_required`. This supports nested claims.", - "default": [ - "scope" - ] + "description": "The subjects allowed to be present in the channel token introspection claim specified by `config.channel_token_introspection_subject_claim`." + }, + "remove_channel_token_claims": { + "type": "array", + "items": { + "type": "string" + }, + "description": "remove claims. It should be an array, and each element is a claim key string.", + "default": [] + }, + "enable_channel_token_introspection": { + "type": "boolean", + "description": "If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to `false`.", + "default": true }, - "channel_token_introspection_audience_claim": { + "access_token_introspection_issuers_allowed": { "type": "array", "items": { "type": "string" }, - "description": "Specify the claim in a channel token introspection to verify against values of `config.channel_token_introspection_audiences_allowed`.", - "default": [ - "aud" - ] + "description": "The issuers allowed to be present in the access token introspection claim specified by `config.access_token_introspection_issuer_claim`." }, - "verify_access_token_introspection_notbefore": { + "verify_access_token_scopes": { "type": "boolean", - "description": "Quickly turn off and on the access token introspection notbefore verification.", - "default": false + "description": "Quickly turn off and on the access token required scopes verification, specified with `config.access_token_scopes_required`.", + "default": true }, - "channel_token_consumer_claim": { + "channel_token_introspection_leeway": { + "type": "number", + "description": "You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be used to time-related claim verification. For example, it will be added to introspection results (`JSON`) `exp` claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection `expiry` verification altogether with `config.verify_channel_token_introspection_expiry`.", + "default": 0 + }, + "verify_channel_token_introspection_scopes": { + "type": "boolean", + "description": "Quickly turn on/off the channel token introspection scopes verification specified with `config.channel_token_introspection_scopes_required`.", + "default": true + }, + "remove_access_token_claims": { "type": "array", "items": { "type": "string" }, - "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an `id`, a `username`, and a `custom_id`. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the policy responds with `403 Forbidden`." + "description": "remove claims. It should be an array, and each element is a claim key string.", + "default": [] }, - "channel_token_introspection_issuers_allowed": { + "channel_token_introspection_required_claims": { "type": "array", "items": { + "type": "array", + "items": { + "type": "string" + } + }, + "description": "Specify the required claims that must be present in the channel token introspection. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." + }, + "add_claims": { + "type": "object", + "additionalProperties": { "type": "string" }, - "description": "The issuers allowed to be present in the channel token introspection claim specified by `config.channel_token_introspection_issuer_claim`." + "description": "Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.", + "default": {} }, - "access_token_notbefore_claim": { + "access_token_introspection_consumer_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the notbefore claim in an access token to verify if the default `nbf` is not used.", - "default": [ - "nbf" - ] + "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter (such as `sub` or `username`) in access token introspection results to the Kong consumer entity." }, - "channel_token_subjects_allowed": { + "channel_token_introspection_body_args": { + "type": "string", + "description": "If you need to pass additional body arguments to introspection endpoint when the policy introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: `resource=` or `a=1&b=&c`." + }, + "access_token_introspection_optional_claims": { "type": "array", "items": { - "type": "string" + "type": "array", + "items": { + "type": "string" + } }, - "description": "The subjects allowed to be present in the channel token claim specified by `config.channel_token_subject_claim`." + "description": "Specify the optional claims of the access token introspection result. These claims are only validated when they are present. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." }, - "channel_token_introspection_notbefore_claim": { + "access_token_introspection_expiry_claim": { "type": "array", "items": { "type": "string" }, - "description": "Specify the notbefore claim in a channel token to verify if the default `nbf` is not used.", + "description": "Specify the expiry claim in an access token introspection to verify if the default `exp` is not used.", "default": [ - "nbf" + "exp" ] }, - "verify_channel_token_introspection_subject": { + "access_token_optional": { "type": "boolean", - "description": "Quickly turn off and on the channel token introspection required subjects verification, specified with `config.channel_token_introspection_subjects_required`.", - "default": true + "description": "If an access token is not provided or no `config.access_token_request_header` is specified, the policy cannot verify the access token. In that case, the policy normally responds with `401 Unauthorized` (client didn't send a token) or `500 Unexpected` (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect", + "default": false }, - "trust_channel_token_introspection": { - "type": "boolean", - "description": "Providing an opaque channel token for policy introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the policy signs a new token. This also applies when using a JWT token with introspection JSON as per config.channel_token_introspection_jwt_claim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.", - "default": true + "channel_token_required_claims": { + "type": "array", + "items": { + "type": "array", + "items": { + "type": "string" + } + }, + "description": "Specify the required claims that must be present in the channel token. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." }, - "enable_channel_token_introspection": { + "verify_channel_token_scopes": { "type": "boolean", - "description": "If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to `false`.", + "description": "Quickly turn on/off the channel token required scopes verification specified with `config.channel_token_scopes_required`.", "default": true }, - "access_token_subject_claim": { + "access_token_required_claims": { "type": "array", "items": { - "type": "string" + "type": "array", + "items": { + "type": "string" + } }, - "description": "Specify the claim in an access token to verify against values of `config.access_token_subjects_allowed`.", - "default": [ - "sub" - ] + "description": "Specify the required claims that must be present in the access token. Every claim is specified by an array. If the array has multiple elements, it means the claim is inside a nested object of the payload." }, - "channel_token_keyset": { - "type": "string", - "description": "The name of the keyset containing signing keys.", - "default": "kong" + "trust_access_token_introspection": { + "type": "boolean", + "description": "Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to `true`, the expiry or scopes are not checked on a payload.", + "default": true }, - "channel_token_upstream_header": { + "channel_token_jwks_uri": { "type": "string", - "description": "This policy removes the `config.channel_token_request_header` from the request after reading its value." - }, - "channel_token_introspection_issuer_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Specify the claim in a channel token introspection to verify against values of `config.channel_token_introspection_issuers_allowed`.", - "default": [ - "iss" - ] - }, - "channel_token_introspection_leeway": { - "type": "number", - "description": "You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be used to time-related claim verification. For example, it will be added to introspection results (`JSON`) `exp` claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection `expiry` verification altogether with `config.verify_channel_token_introspection_expiry`.", - "default": 0 + "description": "If you want to use `config.verify_channel_token_signature`, you must specify the URI where the policy can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the policy, then the policy responds with `401 Unauthorized`." }, - "access_token_subjects_allowed": { + "channel_token_consumer_claim": { "type": "array", "items": { "type": "string" }, - "description": "The subjects allowed to be present in the access token claim specified by `config.access_token_subject_claim`." + "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an `id`, a `username`, and a `custom_id`. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the policy responds with `403 Forbidden`." }, - "channel_token_issuers_allowed": { + "channel_token_introspection_notbefore_claim": { "type": "array", "items": { "type": "string" }, - "description": "The issuers allowed to be present in the channel token claim specified by `config.channel_token_issuer_claim`." - }, - "channel_token_introspection_authorization": { - "type": "string", - "description": "When using `opaque` channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the policy will not try introspection, and instead returns `401 Unauthorized` when using opaque channel tokens." - }, - "channel_token_introspection_hint": { - "type": "string", - "description": "If you need to give `hint` parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a `hint` isn't sent with channel token introspection." + "description": "Specify the notbefore claim in a channel token to verify if the default `nbf` is not used.", + "default": [ + "nbf" + ] }, - "channel_token_introspection_consumer_claim": { + "access_token_audience_claim": { "type": "array", "items": { "type": "string" }, - "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter (such as `sub` or `username`) in channel token introspection results to Kong consumer entity" - }, - "access_token_issuer": { - "type": "string", - "description": "The `iss` claim of a signed or re-signed access token is set to this value. Original `iss` claim of the incoming token (possibly introspected) is stored in `original_iss` claim of the newly signed access token.", - "default": "kong" + "description": "Specify the claim in an access token to verify against values of `config.access_token_audiences_allowed`.", + "default": [ + "aud" + ] }, - "access_token_upstream_header": { + "access_token_keyset_client_password": { "type": "string", - "description": "Removes the `config.access_token_request_header` from the request after reading its value. With `config.access_token_upstream_header`, you can specify the upstream header where the policy adds the Kong signed token. If you don't specify a value, such as use `null` or `\"\"` (empty string), the policy does not even try to sign or re-sign the token.", - "default": "Authorization:Bearer" + "description": "The client password that will be used to authenticate Kong if `access_token_keyset` is a uri that requires Basic Auth. Should be configured together with `access_token_keyset_client_username`", + "x-referenceable": true, + "x-encrypted": true }, - "access_token_signing_algorithm": { + "access_token_jwks_uri_client_password": { "type": "string", - "enum": [ - "ES256", - "ES384", - "ES512", - "EdDSA", - "HS256", - "HS384", - "HS512", - "PS256", - "PS384", - "PS512", - "RS256", - "RS512" - ], - "description": "When this policy sets the upstream header as specified with `config.access_token_upstream_header`, re-signs the original access token using the private keys of the JWT Signer policy. Specify the algorithm that is used to sign the token. The `config.access_token_issuer` specifies which `keyset` is used to sign the new token issued by Kong using the specified signing algorithm.", - "default": "RS256" - }, - "verify_access_token_signature": { - "type": "boolean", - "description": "Quickly turn access token signature verification off and on as needed.", - "default": true - }, - "channel_token_optional": { - "type": "boolean", - "description": "If a channel token is not provided or no `config.channel_token_request_header` is specified, the policy cannot verify the channel token. In that case, the policy normally responds with `401 Unauthorized` (client didn't send a token) or `500 Unexpected` (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect", - "default": false + "description": "The client password that will be used to authenticate Kong if `access_token_jwks_uri` is a uri that requires Basic Auth. Should be configured together with `access_token_jwks_uri_client_username`", + "x-referenceable": true, + "x-encrypted": true }, - "enable_instrumentation": { + "verify_access_token_introspection_notbefore": { "type": "boolean", - "description": "Writes log entries with some added information using `ngx.CRIT` (CRITICAL) level.", + "description": "Quickly turn off and on the access token introspection notbefore verification.", "default": false }, - "access_token_consumer_claim": { + "channel_token_introspection_issuers_allowed": { "type": "array", "items": { "type": "string" }, - "description": "When you set a value for this parameter, the policy tries to map an arbitrary claim specified with this configuration parameter (for example, `sub` or `username`) in an access token to Kong consumer entity." - }, - "access_token_introspection_authorization": { - "type": "string", - "description": "If the introspection endpoint requires client authentication (client being the JWT Signer policy), you can specify the `Authorization` header's value with this configuration parameter." + "description": "The issuers allowed to be present in the channel token introspection claim specified by `config.channel_token_introspection_issuer_claim`." }, - "access_token_introspection_scopes_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Specify the claim/property in access token introspection results (`JSON`) to be verified against values of `config.access_token_introspection_scopes_required`. This supports nested claims. For example, with Keycloak you could use `[ \"realm_access\", \"roles\" ]`, which can be given as `realm_access,roles` (form post). If the claim is not found in access token introspection results, and you have specified `config.access_token_introspection_scopes_required`, the policy responds with `403 Forbidden`.", - "default": [ - "scope" - ] + "verify_channel_token_audience": { + "type": "boolean", + "description": "Quickly turn off and on the channel token required audiences verification, specified with `config.channel_token_audiences_required`.", + "default": true } } }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "model": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "Custom type for representing a foreign key with a null value allowed.", + "x-foreign": true + }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/KafkaConsume.json b/app/_schemas/ai-gateway/policies/KafkaConsume.json index 56b378b1f5b..4ac0f7590be 100644 --- a/app/_schemas/ai-gateway/policies/KafkaConsume.json +++ b/app/_schemas/ai-gateway/policies/KafkaConsume.json @@ -40,6 +40,16 @@ "confluent": { "type": "object", "properties": { + "url": { + "type": "string", + "description": "The URL of the schema registry." + }, + "ttl": { + "type": "number", + "maximum": 3600, + "minimum": 0, + "description": "The TTL in seconds for the schema registry cache." + }, "ssl_verify": { "type": "boolean", "description": "Set to false to disable SSL certificate verification when connecting to the schema registry.", @@ -48,73 +58,6 @@ "authentication": { "type": "object", "properties": { - "oauth2_client": { - "type": "object", - "properties": { - "https_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." - }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", - "default": true - }, - "client_secret_jwt_alg": { - "type": "string", - "enum": [ - "HS256", - "HS512" - ], - "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", - "default": "HS512" - }, - "https_proxy": { - "type": "string", - "description": "The proxy to use when making HTTPS requests to the IdP." - }, - "no_proxy": { - "type": "string", - "description": "A comma-separated list of hosts that should not be proxied." - }, - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Network I/O timeout for requests to the IdP in milliseconds.", - "default": 10000 - }, - "keep_alive": { - "type": "boolean", - "description": "Whether to use keepalive connections to the IdP.", - "default": true - }, - "auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none" - ], - "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", - "default": "client_secret_post" - }, - "http_version": { - "type": "number", - "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", - "default": 1.1 - }, - "http_proxy": { - "type": "string", - "description": "The proxy to use when making HTTP requests to the IdP." - }, - "http_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." - } - } - }, "mode": { "type": "string", "enum": [ @@ -147,6 +90,38 @@ "oauth2": { "type": "object", "properties": { + "token_headers": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra headers to be passed in the token endpoint request." + }, + "client_secret": { + "type": "string", + "description": "The client secret for the application registration in the IdP.", + "x-referenceable": true, + "x-encrypted": true + }, + "password": { + "type": "string", + "description": "The password to use if `config.oauth.grant_type` is set to `password`.", + "x-referenceable": true, + "x-encrypted": true + }, + "token_endpoint": { + "type": "string", + "description": "The token endpoint URI." + }, + "token_post_args": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra post arguments to be passed in the token endpoint request." + }, "grant_type": { "type": "string", "enum": [ @@ -156,15 +131,15 @@ "description": "The OAuth grant type to be used.", "default": "client_credentials" }, - "client_secret": { + "client_id": { "type": "string", - "description": "The client secret for the application registration in the IdP.", + "description": "The client ID for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true }, - "password": { + "username": { "type": "string", - "description": "The password to use if `config.oauth.grant_type` is set to `password`.", + "description": "The username to use if `config.oauth.grant_type` is set to `password`.", "x-referenceable": true, "x-encrypted": true }, @@ -185,55 +160,80 @@ }, "description": "List of audiences passed to the IdP when obtaining a new token.", "default": [] + } + }, + "required": [ + "token_endpoint" + ] + }, + "oauth2_client": { + "type": "object", + "properties": { + "https_proxy": { + "type": "string", + "description": "The proxy to use when making HTTPS requests to the IdP." }, - "client_id": { + "https_proxy_authorization": { "type": "string", - "description": "The client ID for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." }, - "username": { + "no_proxy": { "type": "string", - "description": "The username to use if `config.oauth.grant_type` is set to `password`.", - "x-encrypted": true, - "x-referenceable": true + "description": "A comma-separated list of hosts that should not be proxied." }, - "token_endpoint": { + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Network I/O timeout for requests to the IdP in milliseconds.", + "default": 10000 + }, + "keep_alive": { + "type": "boolean", + "description": "Whether to use keepalive connections to the IdP.", + "default": true + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", + "default": true + }, + "auth_method": { "type": "string", - "description": "The token endpoint URI." + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none" + ], + "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", + "default": "client_secret_post" }, - "token_headers": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra headers to be passed in the token endpoint request." + "client_secret_jwt_alg": { + "type": "string", + "enum": [ + "HS256", + "HS512" + ], + "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", + "default": "HS512" }, - "token_post_args": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra post arguments to be passed in the token endpoint request." + "http_version": { + "type": "number", + "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", + "default": 1.1 + }, + "http_proxy": { + "type": "string", + "description": "The proxy to use when making HTTP requests to the IdP." + }, + "http_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." } - }, - "required": [ - "token_endpoint" - ] + } } } - }, - "url": { - "type": "string", - "description": "The URL of the schema registry." - }, - "ttl": { - "type": "number", - "maximum": 3600, - "minimum": 0, - "description": "The TTL in seconds for the schema registry cache." } } } @@ -262,6 +262,73 @@ "authentication": { "type": "object", "properties": { + "oauth2_client": { + "type": "object", + "properties": { + "http_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." + }, + "https_proxy": { + "type": "string", + "description": "The proxy to use when making HTTPS requests to the IdP." + }, + "keep_alive": { + "type": "boolean", + "description": "Whether to use keepalive connections to the IdP.", + "default": true + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", + "default": true + }, + "auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none" + ], + "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", + "default": "client_secret_post" + }, + "http_version": { + "type": "number", + "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", + "default": 1.1 + }, + "https_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + }, + "no_proxy": { + "type": "string", + "description": "A comma-separated list of hosts that should not be proxied." + }, + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Network I/O timeout for requests to the IdP in milliseconds.", + "default": 10000 + }, + "client_secret_jwt_alg": { + "type": "string", + "enum": [ + "HS256", + "HS512" + ], + "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", + "default": "HS512" + }, + "http_proxy": { + "type": "string", + "description": "The proxy to use when making HTTP requests to the IdP." + } + } + }, "mode": { "type": "string", "enum": [ @@ -294,6 +361,16 @@ "oauth2": { "type": "object", "properties": { + "scopes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of scopes to request from the IdP when obtaining a new token.", + "default": [ + "openid" + ] + }, "token_headers": { "type": "object", "additionalProperties": { @@ -310,28 +387,6 @@ }, "description": "Extra post arguments to be passed in the token endpoint request." }, - "username": { - "type": "string", - "description": "The username to use if `config.oauth.grant_type` is set to `password`.", - "x-referenceable": true, - "x-encrypted": true - }, - "password": { - "type": "string", - "description": "The password to use if `config.oauth.grant_type` is set to `password`.", - "x-referenceable": true, - "x-encrypted": true - }, - "scopes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of scopes to request from the IdP when obtaining a new token.", - "default": [ - "openid" - ] - }, "grant_type": { "type": "string", "enum": [ @@ -341,18 +396,18 @@ "description": "The OAuth grant type to be used.", "default": "client_credentials" }, - "client_id": { - "type": "string", - "description": "The client ID for the application registration in the IdP.", - "x-encrypted": true, - "x-referenceable": true - }, "client_secret": { "type": "string", "description": "The client secret for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true }, + "username": { + "type": "string", + "description": "The username to use if `config.oauth.grant_type` is set to `password`.", + "x-referenceable": true, + "x-encrypted": true + }, "audience": { "type": "array", "items": { @@ -364,78 +419,23 @@ "token_endpoint": { "type": "string", "description": "The token endpoint URI." - } - }, - "required": [ - "token_endpoint" - ] - }, - "oauth2_client": { - "type": "object", - "properties": { - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", - "default": true - }, - "auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none" - ], - "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", - "default": "client_secret_post" - }, - "http_version": { - "type": "number", - "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", - "default": 1.1 - }, - "http_proxy": { - "type": "string", - "description": "The proxy to use when making HTTP requests to the IdP." - }, - "http_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." - }, - "https_proxy": { - "type": "string", - "description": "The proxy to use when making HTTPS requests to the IdP." - }, - "https_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." - }, - "keep_alive": { - "type": "boolean", - "description": "Whether to use keepalive connections to the IdP.", - "default": true }, - "client_secret_jwt_alg": { + "client_id": { "type": "string", - "enum": [ - "HS256", - "HS512" - ], - "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", - "default": "HS512" + "description": "The client ID for the application registration in the IdP.", + "x-referenceable": true, + "x-encrypted": true }, - "no_proxy": { + "password": { "type": "string", - "description": "A comma-separated list of hosts that should not be proxied." - }, - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Network I/O timeout for requests to the IdP in milliseconds.", - "default": 10000 + "description": "The password to use if `config.oauth.grant_type` is set to `password`.", + "x-encrypted": true, + "x-referenceable": true } - } + }, + "required": [ + "token_endpoint" + ] } } }, @@ -454,16 +454,6 @@ }, "description": "The plugin-global schema registry configuration." }, - "mode": { - "type": "string", - "enum": [ - "http-get", - "server-sent-events", - "websocket" - ], - "description": "The mode of operation for the policy.", - "default": "http-get" - }, "message_deserializer": { "type": "string", "enum": [ @@ -482,20 +472,48 @@ "description": "The offset to start from when there is no initial offset in the consumer group.", "default": "latest" }, - "commit_strategy": { - "type": "string", - "enum": [ - "auto", - "off" - ], - "description": "The strategy to use for committing offsets.", - "default": "auto" - }, "enforce_latest_offset_reset": { "type": "boolean", "description": "When true, 'latest' offset reset behaves correctly (starts from end). When false (default), maintains backwards compatibility where 'latest' acts like 'earliest'.", "default": false }, + "authentication": { + "type": "object", + "properties": { + "strategy": { + "type": "string", + "enum": [ + "sasl" + ], + "description": "The authentication strategy for the policy, the only option for the value is `sasl`." + }, + "mechanism": { + "type": "string", + "enum": [ + "PLAIN", + "SCRAM-SHA-256", + "SCRAM-SHA-512" + ], + "description": "The SASL authentication mechanism. Supported options: `PLAIN` or `SCRAM-SHA-256`." + }, + "tokenauth": { + "type": "boolean", + "description": "Enable this to indicate `DelegationToken` authentication" + }, + "user": { + "type": "string", + "description": "Username for SASL authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "password": { + "type": "string", + "description": "Password for SASL authentication.", + "x-referenceable": true, + "x-encrypted": true + } + } + }, "security": { "type": "object", "properties": { @@ -514,6 +532,10 @@ } } }, + "cluster_name": { + "type": "string", + "description": "An identifier for the Kafka cluster." + }, "bootstrap_servers": { "type": "array", "items": { @@ -537,46 +559,24 @@ }, "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." }, - "authentication": { - "type": "object", - "properties": { - "strategy": { - "type": "string", - "enum": [ - "sasl" - ], - "description": "The authentication strategy for the policy, the only option for the value is `sasl`." - }, - "mechanism": { - "type": "string", - "enum": [ - "PLAIN", - "SCRAM-SHA-256", - "SCRAM-SHA-512" - ], - "description": "The SASL authentication mechanism. Supported options: `PLAIN` or `SCRAM-SHA-256`." - }, - "tokenauth": { - "type": "boolean", - "description": "Enable this to indicate `DelegationToken` authentication" - }, - "user": { - "type": "string", - "description": "Username for SASL authentication.", - "x-encrypted": true, - "x-referenceable": true - }, - "password": { - "type": "string", - "description": "Password for SASL authentication.", - "x-referenceable": true, - "x-encrypted": true - } - } + "mode": { + "type": "string", + "enum": [ + "http-get", + "server-sent-events", + "websocket" + ], + "description": "The mode of operation for the policy.", + "default": "http-get" }, - "cluster_name": { + "commit_strategy": { "type": "string", - "description": "An identifier for the Kafka cluster." + "enum": [ + "auto", + "off" + ], + "description": "The strategy to use for committing offsets.", + "default": "auto" }, "message_by_lua_functions": { "type": "array", diff --git a/app/_schemas/ai-gateway/policies/KafkaLog.json b/app/_schemas/ai-gateway/policies/KafkaLog.json index a7aa0140903..0a3679b06f3 100644 --- a/app/_schemas/ai-gateway/policies/KafkaLog.json +++ b/app/_schemas/ai-gateway/policies/KafkaLog.json @@ -26,21 +26,99 @@ "config": { "type": "object", "properties": { + "custom_fields_by_lua": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Lua code as a key-value map" + }, + "topic": { + "type": "string", + "description": "The Kafka topic to publish to." + }, + "keepalive_enabled": { + "type": "boolean", + "default": false + }, + "cluster_name": { + "type": "string", + "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." + }, + "producer_request_limits_bytes_per_request": { + "type": "integer", + "description": "Maximum size of a Produce request in bytes.", + "default": 1048576 + }, + "producer_async": { + "type": "boolean", + "description": "Flag to enable asynchronous mode.", + "default": true + }, + "producer_async_buffering_limits_messages_in_memory": { + "type": "integer", + "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.", + "default": 50000 + }, + "bootstrap_servers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + } + }, + "required": [ + "host", + "port" + ] + }, + "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." + }, + "timeout": { + "type": "integer", + "description": "Socket timeout in milliseconds.", + "default": 10000 + }, + "producer_request_retries_backoff_timeout": { + "type": "integer", + "description": "Backoff interval between retry attempts in milliseconds.", + "default": 100 + }, + "producer_async_flush_timeout": { + "type": "integer", + "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.", + "default": 1000 + }, + "key_query_arg": { + "type": "string", + "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering." + }, + "producer_request_acks": { + "type": "integer", + "enum": [ + -1, + 0, + 1 + ], + "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).", + "default": 1 + }, + "keepalive": { + "type": "integer", + "default": 60000 + }, "authentication": { "type": "object", "properties": { - "user": { - "type": "string", - "description": "Username for SASL authentication.", - "x-referenceable": true, - "x-encrypted": true - }, - "password": { - "type": "string", - "description": "Password for SASL authentication.", - "x-referenceable": true, - "x-encrypted": true - }, "strategy": { "type": "string", "enum": [ @@ -60,6 +138,18 @@ "tokenauth": { "type": "boolean", "description": "Enable this to indicate `DelegationToken` authentication" + }, + "user": { + "type": "string", + "description": "Username for SASL authentication.", + "x-referenceable": true, + "x-encrypted": true + }, + "password": { + "type": "string", + "description": "Password for SASL authentication.", + "x-referenceable": true, + "x-encrypted": true } } }, @@ -69,19 +159,6 @@ "confluent": { "type": "object", "properties": { - "key_schema": { - "type": "object", - "properties": { - "subject_name": { - "type": "string", - "description": "The name of the subject" - }, - "schema_version": { - "type": "string", - "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version." - } - } - }, "url": { "type": "string", "description": "The URL of the schema registry." @@ -100,15 +177,25 @@ "authentication": { "type": "object", "properties": { + "mode": { + "type": "string", + "enum": [ + "basic", + "none", + "oauth2" + ], + "description": "Authentication mode to use with the schema registry.", + "default": "none" + }, "basic": { "type": "object", "properties": { - "password": { + "username": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "username": { + "password": { "type": "string", "x-referenceable": true, "x-encrypted": true @@ -128,16 +215,6 @@ "x-referenceable": true, "x-encrypted": true }, - "scopes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of scopes to request from the IdP when obtaining a new token.", - "default": [ - "openid" - ] - }, "token_headers": { "type": "object", "additionalProperties": { @@ -146,26 +223,27 @@ }, "description": "Extra headers to be passed in the token endpoint request." }, - "grant_type": { + "client_secret": { "type": "string", - "enum": [ - "client_credentials", - "password" - ], - "description": "The OAuth grant type to be used.", - "default": "client_credentials" + "description": "The client secret for the application registration in the IdP.", + "x-encrypted": true, + "x-referenceable": true }, - "client_id": { + "username": { "type": "string", - "description": "The client ID for the application registration in the IdP.", + "description": "The username to use if `config.oauth.grant_type` is set to `password`.", "x-referenceable": true, "x-encrypted": true }, - "client_secret": { - "type": "string", - "description": "The client secret for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true + "scopes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of scopes to request from the IdP when obtaining a new token.", + "default": [ + "openid" + ] }, "audience": { "type": "array", @@ -187,9 +265,18 @@ }, "description": "Extra post arguments to be passed in the token endpoint request." }, - "username": { + "grant_type": { "type": "string", - "description": "The username to use if `config.oauth.grant_type` is set to `password`.", + "enum": [ + "client_credentials", + "password" + ], + "description": "The OAuth grant type to be used.", + "default": "client_credentials" + }, + "client_id": { + "type": "string", + "description": "The client ID for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true } @@ -201,83 +288,86 @@ "oauth2_client": { "type": "object", "properties": { - "auth_method": { + "client_secret_jwt_alg": { "type": "string", "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none" + "HS256", + "HS512" ], - "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", - "default": "client_secret_post" + "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", + "default": "HS512" }, "http_version": { "type": "number", "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", "default": 1.1 }, - "https_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." - }, - "no_proxy": { + "http_proxy_authorization": { "type": "string", - "description": "A comma-separated list of hosts that should not be proxied." + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." }, "keep_alive": { "type": "boolean", "description": "Whether to use keepalive connections to the IdP.", "default": true }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", - "default": true - }, - "client_secret_jwt_alg": { + "auth_method": { "type": "string", "enum": [ - "HS256", - "HS512" + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none" ], - "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", - "default": "HS512" + "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", + "default": "client_secret_post" }, "http_proxy": { "type": "string", "description": "The proxy to use when making HTTP requests to the IdP." }, - "http_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." - }, "https_proxy": { "type": "string", "description": "The proxy to use when making HTTPS requests to the IdP." }, + "https_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + }, + "no_proxy": { + "type": "string", + "description": "A comma-separated list of hosts that should not be proxied." + }, "timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "Network I/O timeout for requests to the IdP in milliseconds.", "default": 10000 + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", + "default": true } } + } + } + }, + "value_schema": { + "type": "object", + "properties": { + "subject_name": { + "type": "string", + "description": "The name of the subject" }, - "mode": { + "schema_version": { "type": "string", - "enum": [ - "basic", - "none", - "oauth2" - ], - "description": "Authentication mode to use with the schema registry.", - "default": "none" + "description": "The schema version to use for serialization/deserialization. Use 'latest' to always fetch the most recent version." } } }, - "value_schema": { + "key_schema": { "type": "object", "properties": { "subject_name": { @@ -295,98 +385,6 @@ }, "description": "The plugin-global schema registry configuration. This can be overwritten by the topic configuration." }, - "producer_request_limits_bytes_per_request": { - "type": "integer", - "description": "Maximum size of a Produce request in bytes.", - "default": 1048576 - }, - "producer_async_flush_timeout": { - "type": "integer", - "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.", - "default": 1000 - }, - "timeout": { - "type": "integer", - "description": "Socket timeout in milliseconds.", - "default": 10000 - }, - "cluster_name": { - "type": "string", - "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." - }, - "producer_request_limits_messages_per_request": { - "type": "integer", - "description": "Maximum number of messages to include into a single Produce request.", - "default": 200 - }, - "producer_request_retries_max_attempts": { - "type": "integer", - "description": "Maximum number of retry attempts per single Produce request.", - "default": 10 - }, - "producer_request_retries_backoff_timeout": { - "type": "integer", - "description": "Backoff interval between retry attempts in milliseconds.", - "default": 100 - }, - "custom_fields_by_lua": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Lua code as a key-value map" - }, - "keepalive_enabled": { - "type": "boolean", - "default": false - }, - "producer_request_acks": { - "type": "integer", - "enum": [ - -1, - 0, - 1 - ], - "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).", - "default": 1 - }, - "producer_request_timeout": { - "type": "integer", - "description": "Time to wait for a Produce response in milliseconds", - "default": 2000 - }, - "producer_async": { - "type": "boolean", - "description": "Flag to enable asynchronous mode.", - "default": true - }, - "bootstrap_servers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - } - }, - "required": [ - "host", - "port" - ] - }, - "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." - }, - "key_query_arg": { - "type": "string", - "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering." - }, "security": { "type": "object", "properties": { @@ -405,18 +403,20 @@ } } }, - "producer_async_buffering_limits_messages_in_memory": { + "producer_request_timeout": { "type": "integer", - "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.", - "default": 50000 + "description": "Time to wait for a Produce response in milliseconds", + "default": 2000 }, - "topic": { - "type": "string", - "description": "The Kafka topic to publish to." + "producer_request_limits_messages_per_request": { + "type": "integer", + "description": "Maximum number of messages to include into a single Produce request.", + "default": 200 }, - "keepalive": { + "producer_request_retries_max_attempts": { "type": "integer", - "default": 60000 + "description": "Maximum number of retry attempts per single Produce request.", + "default": 10 } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/KafkaUpstream.json b/app/_schemas/ai-gateway/policies/KafkaUpstream.json index 052143079ba..0f6971ce0cb 100644 --- a/app/_schemas/ai-gateway/policies/KafkaUpstream.json +++ b/app/_schemas/ai-gateway/policies/KafkaUpstream.json @@ -22,21 +22,6 @@ "config": { "type": "object", "properties": { - "producer_request_retries_max_attempts": { - "type": "integer", - "description": "Maximum number of retry attempts per single Produce request.", - "default": 10 - }, - "producer_async_flush_timeout": { - "type": "integer", - "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.", - "default": 1000 - }, - "producer_async_buffering_limits_messages_in_memory": { - "type": "integer", - "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.", - "default": 50000 - }, "schema_registry": { "type": "object", "properties": { @@ -61,6 +46,73 @@ "authentication": { "type": "object", "properties": { + "oauth2_client": { + "type": "object", + "properties": { + "https_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + }, + "auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none" + ], + "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", + "default": "client_secret_post" + }, + "client_secret_jwt_alg": { + "type": "string", + "enum": [ + "HS256", + "HS512" + ], + "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", + "default": "HS512" + }, + "http_proxy": { + "type": "string", + "description": "The proxy to use when making HTTP requests to the IdP." + }, + "https_proxy": { + "type": "string", + "description": "The proxy to use when making HTTPS requests to the IdP." + }, + "no_proxy": { + "type": "string", + "description": "A comma-separated list of hosts that should not be proxied." + }, + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Network I/O timeout for requests to the IdP in milliseconds.", + "default": 10000 + }, + "keep_alive": { + "type": "boolean", + "description": "Whether to use keepalive connections to the IdP.", + "default": true + }, + "ssl_verify": { + "type": "boolean", + "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", + "default": true + }, + "http_version": { + "type": "number", + "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", + "default": 1.1 + }, + "http_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." + } + } + }, "mode": { "type": "string", "enum": [ @@ -93,23 +145,18 @@ "oauth2": { "type": "object", "properties": { - "token_headers": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra headers to be passed in the token endpoint request." - }, - "client_id": { + "grant_type": { "type": "string", - "description": "The client ID for the application registration in the IdP.", - "x-referenceable": true, - "x-encrypted": true + "enum": [ + "client_credentials", + "password" + ], + "description": "The OAuth grant type to be used.", + "default": "client_credentials" }, - "username": { + "client_secret": { "type": "string", - "description": "The username to use if `config.oauth.grant_type` is set to `password`.", + "description": "The client secret for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true }, @@ -131,6 +178,18 @@ "description": "List of audiences passed to the IdP when obtaining a new token.", "default": [] }, + "token_endpoint": { + "type": "string", + "description": "The token endpoint URI." + }, + "token_headers": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra headers to be passed in the token endpoint request." + }, "token_post_args": { "type": "object", "additionalProperties": { @@ -139,18 +198,15 @@ }, "description": "Extra post arguments to be passed in the token endpoint request." }, - "grant_type": { + "client_id": { "type": "string", - "enum": [ - "client_credentials", - "password" - ], - "description": "The OAuth grant type to be used.", - "default": "client_credentials" + "description": "The client ID for the application registration in the IdP.", + "x-referenceable": true, + "x-encrypted": true }, - "client_secret": { + "username": { "type": "string", - "description": "The client secret for the application registration in the IdP.", + "description": "The username to use if `config.oauth.grant_type` is set to `password`.", "x-referenceable": true, "x-encrypted": true }, @@ -159,82 +215,11 @@ "description": "The password to use if `config.oauth.grant_type` is set to `password`.", "x-referenceable": true, "x-encrypted": true - }, - "token_endpoint": { - "type": "string", - "description": "The token endpoint URI." } }, "required": [ "token_endpoint" ] - }, - "oauth2_client": { - "type": "object", - "properties": { - "client_secret_jwt_alg": { - "type": "string", - "enum": [ - "HS256", - "HS512" - ], - "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", - "default": "HS512" - }, - "http_proxy": { - "type": "string", - "description": "The proxy to use when making HTTP requests to the IdP." - }, - "http_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." - }, - "https_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." - }, - "no_proxy": { - "type": "string", - "description": "A comma-separated list of hosts that should not be proxied." - }, - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Network I/O timeout for requests to the IdP in milliseconds.", - "default": 10000 - }, - "keep_alive": { - "type": "boolean", - "description": "Whether to use keepalive connections to the IdP.", - "default": true - }, - "auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none" - ], - "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", - "default": "client_secret_post" - }, - "http_version": { - "type": "number", - "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", - "default": 1.1 - }, - "https_proxy": { - "type": "string", - "description": "The proxy to use when making HTTPS requests to the IdP." - }, - "ssl_verify": { - "type": "boolean", - "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", - "default": true - } - } } } }, @@ -269,61 +254,61 @@ }, "description": "The plugin-global schema registry configuration. This can be overwritten by the topic configuration." }, - "allowed_topics": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The list of allowed topic names to which messages can be sent. The default topic configured in the `topic` field is always allowed, regardless of its inclusion in `allowed_topics`." - }, - "key_query_arg": { + "topic": { "type": "string", - "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering." + "description": "The default Kafka topic to publish to if the query parameter defined in the `topics_query_arg` does not exist in the request" }, - "forward_method": { - "type": "boolean", - "description": "Include the request method in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", - "default": false + "cluster_name": { + "type": "string", + "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." }, - "forward_uri": { - "type": "boolean", - "description": "Include the request URI and URI arguments (as in, query arguments) in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", - "default": false + "producer_request_limits_bytes_per_request": { + "type": "integer", + "description": "Maximum size of a Produce request in bytes.", + "default": 1048576 }, - "producer_request_acks": { + "producer_request_retries_backoff_timeout": { "type": "integer", - "enum": [ - -1, - 0, - 1 - ], - "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).", - "default": 1 + "description": "Backoff interval between retry attempts in milliseconds.", + "default": 100 }, - "producer_async": { - "type": "boolean", - "description": "Flag to enable asynchronous mode.", - "default": true + "bootstrap_servers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." + } + }, + "required": [ + "host", + "port" + ] + }, + "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." }, - "timeout": { - "type": "integer", - "description": "Socket timeout in milliseconds.", - "default": 10000 + "topics_query_arg": { + "type": "string", + "description": "The request query parameter name that contains the topics to publish to" }, - "keepalive_enabled": { - "type": "boolean", - "default": false + "allowed_topics": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The list of allowed topic names to which messages can be sent. The default topic configured in the `topic` field is always allowed, regardless of its inclusion in `allowed_topics`." }, "authentication": { "type": "object", "properties": { - "strategy": { - "type": "string", - "enum": [ - "sasl" - ], - "description": "The authentication strategy for the policy, the only option for the value is `sasl`." - }, "mechanism": { "type": "string", "enum": [ @@ -346,28 +331,22 @@ "password": { "type": "string", "description": "Password for SASL authentication.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true + }, + "strategy": { + "type": "string", + "enum": [ + "sasl" + ], + "description": "The authentication strategy for the policy, the only option for the value is `sasl`." } } }, - "forward_body": { + "forward_headers": { "type": "boolean", - "description": "Include the request body in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", - "default": true - }, - "cluster_name": { - "type": "string", - "description": "An identifier for the Kafka cluster. By default, this field generates a random string. You can also set your own custom cluster identifier. If more than one Kafka policy is configured without a `cluster_name` (that is, if the default autogenerated value is removed), these policies will use the same producer, and by extension, the same cluster. Logs will be sent to the leader of the cluster." - }, - "producer_request_retries_backoff_timeout": { - "type": "integer", - "description": "Backoff interval between retry attempts in milliseconds.", - "default": 100 - }, - "topics_query_arg": { - "type": "string", - "description": "The request query parameter name that contains the topics to publish to" + "description": "Include the request headers in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", + "default": false }, "message_by_lua_functions": { "type": "array", @@ -376,56 +355,31 @@ }, "description": "The Lua functions that manipulates the message being sent to the Kafka topic." }, - "producer_request_timeout": { - "type": "integer", - "description": "Time to wait for a Produce response in milliseconds.", - "default": 2000 - }, "producer_request_limits_messages_per_request": { "type": "integer", "description": "Maximum number of messages to include into a single producer request.", "default": 200 }, - "producer_request_limits_bytes_per_request": { + "producer_async_flush_timeout": { "type": "integer", - "description": "Maximum size of a Produce request in bytes.", - "default": 1048576 - }, - "bootstrap_servers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - } - }, - "required": [ - "host", - "port" - ] - }, - "description": "Set of bootstrap brokers in a `{host: host, port: port}` list format." + "description": "Maximum time interval in milliseconds between buffer flushes in asynchronous mode.", + "default": 1000 }, - "topic": { + "key_query_arg": { "type": "string", - "description": "The default Kafka topic to publish to if the query parameter defined in the `topics_query_arg` does not exist in the request" + "description": "The request query parameter name that contains the Kafka message key. If specified, messages with the same key will be sent to the same Kafka partition, ensuring consistent ordering." }, - "keepalive": { - "type": "integer", - "description": "Keepalive timeout in milliseconds.", - "default": 60000 + "keepalive_enabled": { + "type": "boolean", + "default": false }, "security": { "type": "object", "properties": { + "certificate_id": { + "type": "string", + "description": "UUID of certificate entity for mTLS authentication." + }, "ssl": { "type": "boolean", "description": "Enables TLS." @@ -434,17 +388,63 @@ "type": "boolean", "description": "When using TLS, this option enables verification of the certificate presented by the server.", "default": true - }, - "certificate_id": { - "type": "string", - "description": "UUID of certificate entity for mTLS authentication." } } }, - "forward_headers": { + "forward_method": { "type": "boolean", - "description": "Include the request headers in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", + "description": "Include the request method in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", + "default": false + }, + "forward_uri": { + "type": "boolean", + "description": "Include the request URI and URI arguments (as in, query arguments) in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", "default": false + }, + "forward_body": { + "type": "boolean", + "description": "Include the request body in the message. At least one of these must be true: `forward_method`, `forward_uri`, `forward_headers`, `forward_body`.", + "default": true + }, + "producer_request_acks": { + "type": "integer", + "enum": [ + -1, + 0, + 1 + ], + "description": "The number of acknowledgments the producer requires the leader to have received before considering a request complete. Allowed values: 0 for no acknowledgments; 1 for only the leader; and -1 for the full ISR (In-Sync Replica set).", + "default": 1 + }, + "producer_async": { + "type": "boolean", + "description": "Flag to enable asynchronous mode.", + "default": true + }, + "timeout": { + "type": "integer", + "description": "Socket timeout in milliseconds.", + "default": 10000 + }, + "keepalive": { + "type": "integer", + "description": "Keepalive timeout in milliseconds.", + "default": 60000 + }, + "producer_request_timeout": { + "type": "integer", + "description": "Time to wait for a Produce response in milliseconds.", + "default": 2000 + }, + "producer_request_retries_max_attempts": { + "type": "integer", + "description": "Maximum number of retry attempts per single Produce request.", + "default": 10 + }, + "producer_async_buffering_limits_messages_in_memory": { + "type": "integer", + "description": "Maximum number of messages that can be buffered in memory in asynchronous mode.", + "default": 50000 } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/KeyAuth.json b/app/_schemas/ai-gateway/policies/KeyAuth.json index e3a6193164a..6716c184a5c 100644 --- a/app/_schemas/ai-gateway/policies/KeyAuth.json +++ b/app/_schemas/ai-gateway/policies/KeyAuth.json @@ -1,5 +1,28 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, "model": { "type": "object", "properties": { @@ -13,6 +36,21 @@ "config": { "type": "object", "properties": { + "key_names": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing an HTTP header name." + }, + "description": "Describes an array of parameter names where the policy will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen.", + "default": [ + "apikey" + ] + }, + "anonymous": { + "type": "string", + "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`." + }, "key_in_header": { "type": "boolean", "description": "If enabled (default), the policy reads the request header and tries to find the key in it.", @@ -23,6 +61,11 @@ "description": "If enabled (default), the policy reads the query parameter in the request and tries to find the key in it.", "default": true }, + "hide_credentials": { + "type": "boolean", + "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service. If `true`, the policy strips the credential from the request.", + "default": true + }, "key_in_body": { "type": "boolean", "description": "If enabled, the policy reads the request body. Supported MIME types: `application/www-form-urlencoded`, `application/json`, and `multipart/form-data`.", @@ -33,6 +76,10 @@ "description": "A boolean value that indicates whether the policy should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests are always allowed.", "default": true }, + "realm": { + "type": "string", + "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." + }, "identity_realms": { "type": "array", "items": { @@ -60,6 +107,11 @@ "principals": { "type": "object", "properties": { + "error_on_miss": { + "type": "boolean", + "description": "When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead.", + "default": true + }, "enabled": { "type": "boolean", "description": "When true, authenticate against Kong Identity instead of local credentials.", @@ -69,63 +121,11 @@ "type": "string", "description": "The Kong Identity directory instance to authenticate against.", "default": "default" - }, - "error_on_miss": { - "type": "boolean", - "description": "When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead.", - "default": true } } - }, - "key_names": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing an HTTP header name." - }, - "description": "Describes an array of parameter names where the policy will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen.", - "default": [ - "apikey" - ] - }, - "hide_credentials": { - "type": "boolean", - "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service. If `true`, the policy strips the credential from the request.", - "default": true - }, - "anonymous": { - "type": "string", - "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`." - }, - "realm": { - "type": "string", - "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/KeyAuthEnc.json b/app/_schemas/ai-gateway/policies/KeyAuthEnc.json index 940c8342137..c44c0bbc46d 100644 --- a/app/_schemas/ai-gateway/policies/KeyAuthEnc.json +++ b/app/_schemas/ai-gateway/policies/KeyAuthEnc.json @@ -1,5 +1,28 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, "model": { "type": "object", "properties": { @@ -13,6 +36,11 @@ "config": { "type": "object", "properties": { + "key_in_body": { + "type": "boolean", + "description": "If enabled, the policy reads the request body (if said request has one and its MIME type is supported) and tries to find the key in it. Supported MIME types: `application/www-form-urlencoded`, `application/json`, and `multipart/form-data`.", + "default": false + }, "run_on_preflight": { "type": "boolean", "description": "A boolean value that indicates whether the policy should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests are always allowed.", @@ -51,37 +79,9 @@ "type": "boolean", "description": "If enabled (default), the policy reads the query parameter in the request and tries to find the key in it.", "default": true - }, - "key_in_body": { - "type": "boolean", - "description": "If enabled, the policy reads the request body (if said request has one and its MIME type is supported) and tries to find the key in it. Supported MIME types: `application/www-form-urlencoded`, `application/json`, and `multipart/form-data`.", - "default": false } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/KonnectApplicationAuth.json b/app/_schemas/ai-gateway/policies/KonnectApplicationAuth.json index debd7f2f0f1..a5b076cfcfb 100644 --- a/app/_schemas/ai-gateway/policies/KonnectApplicationAuth.json +++ b/app/_schemas/ai-gateway/policies/KonnectApplicationAuth.json @@ -1,12 +1,45 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "auth_type": { + "type": "string", + "enum": [ + "key-auth", + "openid-connect", + "v2-strategies" + ], + "description": "The type of authentication to be performed. Possible values are: 'openid-connect', 'key-auth', 'v2-strategies'.", + "default": "openid-connect" + }, + "scope": { + "type": "string", + "description": "The unique scope identifier for the policy configuration." + }, "v2_strategies": { "type": "object", "properties": { - "openid_connect": { + "key_auth": { "type": "array", "items": { "type": "object", @@ -28,333 +61,337 @@ "config": { "type": "object", "properties": { - "introspection_headers_values": { - "type": "array", - "items": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra header values passed to the introspection endpoint.", - "x-encrypted": true - }, - "upstream_user_info_jwt_header": { - "type": "string", - "description": "The upstream user info JWT header (in case the user info returns a JWT response)." - }, - "downstream_id_token_header": { - "type": "string", - "description": "The downstream id token header." - }, - "unexpected_redirect_uri": { + "key_names": { "type": "array", "items": { "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." + "description": "A string representing an HTTP header name." }, - "description": "Where to redirect the client when unexpected errors happen with the requests." - }, - "token_headers_grants": { + "description": "The names of the headers containing the API key. You can specify multiple header names.", + "default": [ + "apikey" + ] + } + } + } + }, + "required": [ + "strategy_id" + ] + }, + "description": "List of key_auth strategies." + }, + "openid_connect": { + "type": "array", + "items": { + "type": "object", + "properties": { + "strategy_id": { + "type": "string", + "description": "The strategy id the config is tied to." + }, + "principals": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "When true, fetch application principal from Kong Identity after authentication", + "default": false + } + } + }, + "config": { + "type": "object", + "properties": { + "scopes_claim": { "type": "array", "items": { - "type": "string", - "enum": [ - "authorization_code", - "client_credentials", - "password", - "refresh_token" - ] + "type": "string" }, - "description": "Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant." + "description": "The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "scope" + ] }, - "upstream_id_token_header": { + "authorization_cookie_name": { "type": "string", - "description": "The upstream id token header." - }, - "consumer_groups_optional": { - "type": "boolean", - "description": "Do not terminate the request if consumer groups mapping fails.", - "default": false - }, - "display_errors": { - "type": "boolean", - "description": "Display errors on failure responses.", - "default": false + "description": "The authorization cookie name.", + "default": "authorization" }, - "dpop_use_nonce": { + "session_cookie_secure": { "type": "boolean", - "description": "Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.", - "default": false - }, - "forbidden_redirect_uri": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "description": "Where to redirect the client on forbidden requests." - }, - "authorization_query_args_values": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra query argument values passed to the authorization endpoint." + "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." }, - "jwt_session_claim": { + "upstream_id_token_header": { "type": "string", - "description": "The claim to match against the JWT session cookie.", - "default": "sid" + "description": "The upstream id token header." }, - "upstream_headers_claims": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The upstream header claims. Only top level claims are supported." + "unauthorized_destroy_session": { + "type": "boolean", + "description": "Destroy any active session for the unauthorized requests.", + "default": true }, - "login_methods": { + "scopes": { "type": "array", "items": { "type": "string", - "enum": [ - "authorization_code", - "bearer", - "client_credentials", - "introspection", - "kong_oauth2", - "password", - "refresh_token", - "session", - "userinfo" - ] + "x-referenceable": true }, - "description": "Enable login functionality with specified grants.", + "description": "The scopes passed to the authorization and token endpoints.", "default": [ - "authorization_code" + "openid" ] }, - "authorization_query_args_names": { + "audience_required": { "type": "array", "items": { "type": "string" }, - "description": "Extra query argument names passed to the authorization endpoint." - }, - "no_proxy": { - "type": "string", - "description": "Do not use proxy with these hosts." + "description": "The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." }, - "revocation_token_param_name": { + "session_cookie_same_site": { "type": "string", - "description": "Designate token's parameter name for revocation.", - "default": "token" - }, - "unauthorized_redirect_uri": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "description": "Where to redirect the client on unauthorized requests." + "enum": [ + "Default", + "Lax", + "None", + "Strict" + ], + "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", + "default": "Lax" }, - "rediscovery_lifetime": { - "type": "number", - "description": "Specifies how long (in seconds) the policy waits between discovery attempts. Discovery is still triggered on an as-needed basis.", - "default": 30 + "session_memcached_ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the memcached server SSL certificate", + "default": true }, - "client_arg": { + "upstream_user_info_header": { "type": "string", - "description": "The client to use for this request (the selection is made with a request parameter with the same name).", - "default": "client_id" - }, - "cache_ttl": { - "type": "number", - "description": "The default cache ttl in seconds that is used in case the cached object does not specify the expiry.", - "default": 3600 + "description": "The upstream user info header." }, - "id_token_param_type": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "body", - "header", - "query" - ] - }, - "description": "Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", - "default": [ - "body", - "header", - "query" - ] + "logout_query_arg": { + "type": "string", + "description": "The request query argument that activates the logout." }, - "hide_credentials": { + "cache_introspection": { "type": "boolean", - "description": "Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the policy will remove those that were used for successful authentication.", + "description": "Cache the introspection endpoint requests.", "default": true }, - "login_redirect_uri": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "x-referenceable": true - }, - "description": "Where to redirect the client when `login_action` is set to `redirect`." - }, - "session_cookie_name": { - "type": "string", - "description": "The session cookie name.", - "default": "session" - }, - "downstream_access_token_header": { + "proof_of_possession_mtls": { "type": "string", - "description": "The downstream access token header." + "enum": [ + "off", + "optional", + "strict" + ], + "description": "Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.", + "default": "off" }, - "search_user_info": { - "type": "boolean", - "description": "Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.", - "default": false + "token_exchange": { + "type": "object", + "properties": { + "subject_token_issuers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "conditions": { + "type": "object", + "properties": { + "has_audience": { + "type": "array", + "items": { + "type": "string" + } + }, + "missing_audience": { + "type": "array", + "items": { + "type": "string" + } + }, + "has_scopes": { + "type": "array", + "items": { + "type": "string" + } + }, + "missing_scopes": { + "type": "array", + "items": { + "type": "string" + } + } + }, + "description": "A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined." + }, + "issuer": { + "type": "string", + "description": "Tokens of whose iss claim matches this value will be exchanged." + } + }, + "required": [ + "issuer" + ] + }, + "minLength": 1, + "description": "Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged." + }, + "request": { + "type": "object", + "properties": { + "scopes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Scopes used in the token exchange request. Values defined here override those defined in `config.scopes`." + }, + "empty_scopes": { + "type": "boolean", + "description": "Use empty scopes. Use this field to override scopes defined in `config.scopes`.", + "default": false + }, + "audience": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Audiences used in the token exchange request. Values defined here override those defined in `config.audience`." + }, + "empty_audience": { + "type": "boolean", + "description": "Use empty audiences. Use this field to override audiences defined in `config.audience`.", + "default": false + } + }, + "description": "Parameters used in the token exchange request." + }, + "cache": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "Whether to enable caching.", + "default": true + }, + "ttl": { + "type": "integer", + "description": "Cache ttl in seconds used when caching exchanged tokens, use it to override `conf.cache_ttl`. Token expiry will be used if shorter than this value." + } + }, + "description": "Cache support for token exchange" + } + }, + "required": [ + "subject_token_issuers" + ], + "description": "Details on how to accept tokens from other identity providers." }, - "userinfo_accept": { + "authorization_cookie_domain": { "type": "string", - "enum": [ - "application/json", - "application/jwt" - ], - "description": "The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).", - "default": "application/json" + "description": "The authorization cookie Domain flag." }, - "session_hash_subject": { + "session_enforce_same_subject": { "type": "boolean", - "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.", + "description": "When set to `true`, audiences are forced to share the same subject.", "default": false }, "redis": { "type": "object", "properties": { - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, "server_name": { "type": "string", "description": "A string representing an SNI (server name indication) value for TLS.", "x-referenceable": true }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, "prefix": { "type": "string", "description": "The Redis session key prefix." }, - "socket": { - "type": "string", - "description": "The Redis unix socket path." + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, "username": { "type": "string", "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_master": { + "password": { "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", "x-referenceable": true }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true }, "cloud_authentication": { "type": "object", "properties": { - "aws_role_session_name": { - "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_service_account_json": { + "auth_provider": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true }, "aws_cache_name": { "type": "string", "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, "aws_assume_role_arn": { "type": "string", "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_id": { + "gcp_service_account_json": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-encrypted": true, + "x-referenceable": true }, - "azure_client_secret": { + "azure_client_id": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, "azure_tenant_id": { "type": "string", "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, - "auth_provider": { + "aws_region": { "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, "aws_is_serverless": { @@ -373,17 +410,33 @@ "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true - } - }, - "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + } + }, + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, "sentinel_nodes": { "type": "array", "items": { @@ -406,17 +459,22 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false }, - "connect_timeout": { + "socket": { + "type": "string", + "description": "The Redis unix socket path." + }, + "port": { "type": "integer", - "maximum": 2147483646, + "maximum": 65535, "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true }, "read_timeout": { "type": "integer", @@ -425,22 +483,15 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-encrypted": true, - "x-referenceable": true - }, "sentinel_username": { "type": "string", "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 }, "sentinel_role": { "type": "string", @@ -451,6 +502,27 @@ ], "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, "cluster_nodes": { "type": "array", "items": { @@ -472,572 +544,436 @@ }, "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false } } }, - "cache_ttl_neg": { - "type": "number", - "description": "The negative cache ttl in seconds." + "downstream_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The downstream header names for the claim values." }, - "session_memcached_socket": { + "downstream_introspection_header": { "type": "string", - "description": "The memcached unix socket path." + "description": "The downstream introspection header." }, - "session_memcached_ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the memcached server SSL certificate", - "default": true + "discovery_headers_values": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header values passed to the discovery endpoint." }, - "cache_introspection": { + "token_post_args_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra post argument names passed to the token endpoint." + }, + "logout_revoke_access_token": { "type": "boolean", - "description": "Cache the introspection endpoint requests.", + "description": "Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.", "default": true }, - "cache_user_info": { + "logout_revoke_refresh_token": { "type": "boolean", - "description": "Cache the user info requests.", + "description": "Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.", "default": true }, - "proof_of_possession_mtls": { - "type": "string", - "enum": [ - "off", - "optional", - "strict" - ], - "description": "Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.", - "default": "off" - }, - "issuers_allowed": { - "type": "array", - "items": { - "type": "string", - "x-referenceable": true - }, - "description": "The issuers allowed to be present in the tokens (`iss` claim)." - }, - "token_headers_values": { + "token_post_args_values": { "type": "array", "items": { "type": "string" }, - "description": "Extra header values passed to the token endpoint." + "description": "Extra post argument values passed to the token endpoint." }, - "userinfo_headers_client": { + "upstream_headers": { "type": "array", "items": { - "type": "string" + "type": "object", + "properties": { + "header": { + "type": "string", + "description": "The name of the header." + }, + "path": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "The path of the header value." + } + }, + "required": [ + "header", + "path" + ] }, - "description": "Extra headers passed from the client to the user info endpoint." + "description": "The upstream claim to header mappings." }, - "revocation_endpoint": { - "type": "string", - "description": "The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint." + "resolve_distributed_claims": { + "type": "boolean", + "description": "Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the policy explicitly resolves these distributed claims.", + "default": false }, - "userinfo_query_args_names": { + "introspection_headers_client": { "type": "array", "items": { "type": "string" }, - "description": "Extra query argument names passed to the user info endpoint." + "description": "Extra headers passed from the client to the introspection endpoint." }, - "token_post_args_names": { + "userinfo_query_args_client": { "type": "array", "items": { "type": "string" }, - "description": "Extra post argument names passed to the token endpoint." - }, - "downstream_access_token_jwk_header": { - "type": "string", - "description": "The downstream access token JWK header." + "description": "Extra query arguments passed from the client to the user info endpoint." }, - "authenticated_groups_claim": { + "id_token_param_type": { "type": "array", "items": { - "type": "string" + "type": "string", + "enum": [ + "body", + "header", + "query" + ] }, - "description": "The claim that contains authenticated groups. This setting can be used together with ACL policy, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload." + "description": "Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] }, - "introspection_headers_names": { + "authorization_query_args_names": { "type": "array", "items": { "type": "string" }, - "description": "Extra header names passed to the introspection endpoint." + "description": "Extra query argument names passed to the authorization endpoint." }, - "logout_query_arg": { + "session_memcached_socket": { "type": "string", - "description": "The request query argument that activates the logout." + "description": "The memcached unix socket path." }, - "logout_revoke": { - "type": "boolean", - "description": "Revoke tokens as part of the logout.\n\nFor more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.", - "default": false + "upstream_introspection_header": { + "type": "string", + "description": "The upstream introspection header." }, - "logout_revoke_refresh_token": { - "type": "boolean", - "description": "Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.", - "default": true + "downstream_id_token_header": { + "type": "string", + "description": "The downstream id token header." }, - "session_idling_timeout": { - "type": "number", - "description": "Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.", - "default": 900 + "mtls_token_endpoint": { + "type": "string", + "description": "Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." }, - "session_response_headers": { + "client_id": { "type": "array", "items": { "type": "string", - "enum": [ - "absolute-timeout", - "audience", - "id", - "idling-timeout", - "rolling-timeout", - "subject", - "timeout" - ] + "x-referenceable": true }, - "description": "Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout response headers." + "description": "The client id(s) that the policy uses when it calls authenticated endpoints on the identity provider.", + "x-encrypted": true }, - "session_enforce_same_subject": { + "authorization_cookie_secure": { "type": "boolean", - "description": "When set to `true`, audiences are forced to share the same subject.", - "default": false + "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." }, - "downstream_introspection_jwt_header": { - "type": "string", - "description": "The downstream introspection JWT header." - }, - "logout_methods": { + "userinfo_headers_client": { "type": "array", "items": { - "type": "string", - "enum": [ - "DELETE", - "GET", - "POST" - ] + "type": "string" }, - "description": "The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.", - "default": [ - "DELETE", - "POST" - ] + "description": "Extra headers passed from the client to the user info endpoint." }, - "dpop_proof_lifetime": { - "type": "number", - "description": "Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.", - "default": 300 + "session_memcached_ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to memcached" }, - "token_headers_replay": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The names of token endpoint response headers to forward to the downstream client." + "bearer_token_header_name": { + "type": "string", + "description": "The name of the HTTP header from which the bearer token is retrieved. The default value is `authorization:bearer`, which reads the token from the `Authorization: Bearer ` header. Accepts plain header names such as `x-my-token` as well as Kong's special `authorization:bearer` notation. The `access-token` and `x-access-token` headers are also checked as a fallback for backward compatibility regardless of this setting.", + "default": "authorization:bearer" }, - "userinfo_query_args_values": { + "downstream_headers_claims": { "type": "array", "items": { "type": "string" }, - "description": "Extra query argument values passed to the user info endpoint." + "description": "The downstream header claims. Only top level claims are supported." }, - "session_audience": { + "issuer": { "type": "string", - "description": "The session audience, which is the intended target application. For example `\"my-application\"`.", - "default": "default" + "description": "The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.", + "x-referenceable": true }, - "cache_ttl_max": { - "type": "number", - "description": "The maximum cache ttl in seconds (enforced)." + "revocation_endpoint": { + "type": "string", + "description": "The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint." }, - "session_cookie_path": { + "userinfo_accept": { "type": "string", - "description": "The session cookie Path flag.", - "default": "/" + "enum": [ + "application/json", + "application/jwt" + ], + "description": "The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).", + "default": "application/json" }, - "session_cookie_secure": { - "type": "boolean", - "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." + "id_token_param_name": { + "type": "string", + "description": "The name of the parameter used to pass the id token." }, - "session_hash_storage_key": { + "run_on_preflight": { "type": "boolean", - "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.", - "default": false - }, - "upstream_headers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "header": { - "type": "string", - "description": "The name of the header." - }, - "path": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "The path of the header value." - } - }, - "required": [ - "header", - "path" - ] - }, - "description": "The upstream claim to header mappings." - }, - "upstream_introspection_header": { - "type": "string", - "description": "The upstream introspection header." + "description": "Specifies whether to run this policy on pre-flight (`OPTIONS`) requests.", + "default": true }, - "upstream_session_id_header": { + "tls_client_auth_cert_id": { "type": "string", - "description": "The upstream session id header." + "description": "ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server." }, - "login_tokens": { + "unexpected_redirect_uri": { "type": "array", "items": { "type": "string", - "enum": [ - "access_token", - "id_token", - "introspection", - "refresh_token", - "tokens" - ] + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." }, - "description": "What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.", - "default": [ - "id_token" - ] + "description": "Where to redirect the client when unexpected errors happen with the requests." }, - "session_remember_rolling_timeout": { - "type": "number", - "description": "Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.", - "default": 604800 + "session_store_metadata": { + "type": "boolean", + "description": "Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.", + "default": false }, - "introspection_token_param_name": { + "anonymous": { "type": "string", - "description": "Designate token's parameter name for introspection.", - "default": "token" + "description": "An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." }, - "userinfo_query_args_client": { + "consumer_groups_claim": { "type": "array", "items": { "type": "string" }, - "description": "Extra query arguments passed from the client to the user info endpoint." + "description": "The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload." }, - "upstream_id_token_jwk_header": { - "type": "string", - "description": "The upstream id token JWK header." + "logout_redirect_uri": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "x-referenceable": true + }, + "description": "Where to redirect the client after the logout." }, - "response_mode": { + "login_redirect_mode": { "type": "string", "enum": [ - "form_post", - "form_post.jwt", "fragment", - "fragment.jwt", - "jwt", - "query", - "query.jwt" + "query" ], - "description": "Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the policy itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.", - "default": "query" - }, - "audience": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The audience passed to the authorization endpoint." + "description": "Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).", + "default": "fragment" }, - "token_headers_names": { + "credential_claim": { "type": "array", "items": { "type": "string" }, - "description": "Extra header names passed to the token endpoint." + "description": "The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting policy), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "sub" + ] }, - "anonymous": { + "http_proxy_authorization": { "type": "string", - "description": "An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." - }, - "ssl_verify": { - "type": "boolean", - "description": "Verify identity provider server certificate. If set to `true`, the policy uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.", - "default": true + "description": "The HTTP proxy authorization.", + "x-referenceable": true }, - "tls_client_auth_cert_id": { + "session_memcached_host": { "type": "string", - "description": "ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server." + "description": "The memcached host.", + "default": "127.0.0.1" }, - "verify_parameters": { + "verify_signature": { "type": "boolean", - "description": "Verify policy configuration against discovery.", - "default": false + "description": "Verify the cryptographic signature of tokens. Disabling this skips verification for every token source, including tokens presented directly by clients (bearer); this is insecure for that path. To trust only tokens fetched from the identity provider for specific grants, use `ignore_signature` instead, which never affects bearer tokens.", + "default": true }, - "ignore_signature": { + "scopes_required": { "type": "array", "items": { - "type": "string", - "enum": [ - "authorization_code", - "client_credentials", - "introspection", - "password", - "refresh_token", - "session", - "userinfo" - ] + "type": "string" }, - "description": "Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.", - "default": [] - }, - "by_username_ignore_case": { - "type": "boolean", - "description": "If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.", - "default": false + "description": "The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." }, - "introspection_post_args_client_headers": { + "introspection_post_args_names": { "type": "array", "items": { "type": "string" }, - "description": "Extra post arguments passed from the client headers to the introspection endpoint." + "description": "Extra post argument names passed to the introspection endpoint." }, - "jwt_session_cookie": { + "session_remember_cookie_name": { "type": "string", - "description": "The name of the JWT session cookie." + "description": "Persistent session cookie name. Use with the `remember` configuration parameter.", + "default": "remember" }, - "downstream_headers_claims": { + "downstream_user_info_jwt_header": { + "type": "string", + "description": "The downstream user info JWT header (in case the user info returns a JWT response)." + }, + "logout_uri_suffix": { + "type": "string", + "description": "The request URI suffix that activates the logout." + }, + "roles_claim": { "type": "array", "items": { "type": "string" }, - "description": "The downstream header claims. Only top level claims are supported." + "description": "The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "roles" + ] }, - "downstream_headers_names": { + "domains": { "type": "array", "items": { "type": "string" }, - "description": "The downstream header names for the claim values." + "description": "The allowed values for the `hd` claim." }, - "downstream_session_id_header": { - "type": "string", - "description": "The downstream session id header." + "authorization_cookie_http_only": { + "type": "boolean", + "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", + "default": true }, - "session_bind": { - "type": "array", + "forbidden_destroy_session": { + "type": "boolean", + "description": "Destroy any active session for the forbidden requests.", + "default": true + }, + "leeway": { + "type": "number", + "description": "Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims", + "default": 0 + }, + "rediscovery_lifetime": { + "type": "number", + "description": "Specifies how long (in seconds) the policy waits between discovery attempts. Discovery is still triggered on an as-needed basis.", + "default": 30 + }, + "forbidden_redirect_uri": { + "type": "array", "items": { "type": "string", - "enum": [ - "ip", - "scheme", - "user-agent" - ] + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." }, - "description": "Bind the session to data acquired from the HTTP request or connection." - }, - "introspection_endpoint": { - "type": "string", - "description": "The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.", - "x-referenceable": true + "description": "Where to redirect the client on forbidden requests." }, - "introspection_headers_client": { + "token_headers_names": { "type": "array", "items": { "type": "string" }, - "description": "Extra headers passed from the client to the introspection endpoint." + "description": "Extra header names passed to the token endpoint." }, - "login_redirect_mode": { + "revocation_endpoint_auth_method": { "type": "string", "enum": [ - "fragment", - "query" + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" ], - "description": "Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).", - "default": "fragment" + "description": "The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" }, "logout_post_arg": { "type": "string", "description": "The request body argument that activates the logout." }, - "response_type": { + "extra_jwks_uris": { "type": "array", "items": { - "type": "string" + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "x-referenceable": true }, - "description": "The response type passed to the authorization endpoint.", - "default": [ - "code" - ] + "description": "JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery)." }, - "audience_required": { + "token_headers_client": { "type": "array", "items": { "type": "string" }, - "description": "The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." + "description": "Extra headers passed from the client to the token endpoint." }, - "bearer_token_cookie_name": { + "jwt_session_cookie": { "type": "string", - "description": "The name of the cookie in which the bearer token is passed." + "description": "The name of the JWT session cookie." }, - "bearer_token_header_name": { + "upstream_id_token_jwk_header": { "type": "string", - "description": "The name of the HTTP header from which the bearer token is retrieved. The default value is `authorization:bearer`, which reads the token from the `Authorization: Bearer ` header. Accepts plain header names such as `x-my-token` as well as Kong's special `authorization:bearer` notation. The `access-token` and `x-access-token` headers are also checked as a fallback for backward compatibility regardless of this setting.", - "default": "authorization:bearer" + "description": "The upstream id token JWK header." }, - "refresh_token_param_type": { + "session_request_headers": { "type": "array", "items": { "type": "string", "enum": [ - "body", - "header", - "query" + "absolute-timeout", + "audience", + "id", + "idling-timeout", + "rolling-timeout", + "subject", + "timeout" ] }, - "description": "Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", - "default": [ - "body", - "header", - "query" - ] + "description": "Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout request headers." }, - "client_secret": { + "userinfo_query_args_names": { "type": "array", "items": { - "type": "string", - "x-referenceable": true + "type": "string" }, - "description": "The client secret.", - "x-encrypted": true - }, - "authorization_cookie_same_site": { - "type": "string", - "enum": [ - "Default", - "Lax", - "None", - "Strict" - ], - "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", - "default": "Default" + "description": "Extra query argument names passed to the user info endpoint." }, - "token_headers_prefix": { + "session_cookie_domain": { "type": "string", - "description": "Add a prefix to the token endpoint response headers before forwarding them to the downstream client." + "description": "The session cookie Domain flag." }, - "verify_signature": { + "session_cookie_http_only": { "type": "boolean", - "description": "Verify the cryptographic signature of tokens. Disabling this skips verification for every token source, including tokens presented directly by clients (bearer); this is insecure for that path. To trust only tokens fetched from the identity provider for specific grants, use `ignore_signature` instead, which never affects bearer tokens.", + "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", "default": true }, - "https_proxy": { - "type": "string", - "description": "The HTTPS proxy." - }, - "https_proxy_authorization": { - "type": "string", - "description": "The HTTPS proxy authorization.", - "x-referenceable": true - }, - "userinfo_headers_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra header names passed to the user info endpoint." - }, - "auth_methods": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "authorization_code", - "bearer", - "client_credentials", - "introspection", - "kong_oauth2", - "password", - "refresh_token", - "session", - "userinfo" - ] - }, - "description": "Types of credentials/grants to enable.", - "default": [ - "authorization_code", - "bearer", - "client_credentials", - "introspection", - "kong_oauth2", - "password", - "refresh_token", - "session", - "userinfo" - ] - }, - "logout_redirect_uri": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "x-referenceable": true - }, - "description": "Where to redirect the client after the logout." - }, - "token_endpoint_auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ], - "description": "The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" - }, - "revocation_endpoint_auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ], - "description": "The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" + "session_memcached_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "The memcached port.", + "default": 11211 }, - "downstream_introspection_header": { + "downstream_refresh_token_header": { "type": "string", - "description": "The downstream introspection header." + "description": "The downstream refresh token header." }, - "issuer": { + "introspection_token_param_name": { "type": "string", - "description": "The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.", - "x-referenceable": true + "description": "Designate token's parameter name for introspection.", + "default": "token" }, "authorization_query_args_client": { "type": "array", @@ -1046,543 +982,103 @@ }, "description": "Extra query arguments passed from the client to the authorization endpoint." }, - "session_absolute_timeout": { - "type": "number", - "description": "Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", - "default": 86400 - }, - "downstream_user_info_header": { + "introspection_endpoint": { "type": "string", - "description": "The downstream user info header." + "description": "The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.", + "x-referenceable": true }, - "cache_ttl_min": { + "session_remember_absolute_timeout": { "type": "number", - "description": "The minimum cache ttl in seconds (enforced)." + "description": "Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", + "default": 2592000 }, - "resolve_distributed_claims": { - "type": "boolean", - "description": "Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the policy explicitly resolves these distributed claims.", - "default": false + "refresh_token_param_name": { + "type": "string", + "description": "The name of the parameter used to pass the refresh token." }, - "proof_of_possession_auth_methods_validation": { + "refresh_tokens": { "type": "boolean", - "description": "If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.", + "description": "Specifies whether the policy should try to refresh (soon to be) expired access tokens if the policy has a `refresh_token` available.", "default": true }, - "forbidden_error_message": { + "upstream_introspection_jwt_header": { "type": "string", - "description": "The error message for the forbidden requests (when not using the redirection).", - "default": "Forbidden" - }, - "leeway": { - "type": "number", - "description": "Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims", - "default": 0 + "description": "The upstream introspection JWT header." }, - "proof_of_possession_dpop": { + "downstream_access_token_header": { "type": "string", - "enum": [ - "off", - "optional", - "strict" - ], - "description": "Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.", - "default": "off" - }, - "token_exchange": { - "type": "object", - "properties": { - "request": { - "type": "object", - "properties": { - "scopes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Scopes used in the token exchange request. Values defined here override those defined in `config.scopes`." - }, - "empty_scopes": { - "type": "boolean", - "description": "Use empty scopes. Use this field to override scopes defined in `config.scopes`.", - "default": false - }, - "audience": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Audiences used in the token exchange request. Values defined here override those defined in `config.audience`." - }, - "empty_audience": { - "type": "boolean", - "description": "Use empty audiences. Use this field to override audiences defined in `config.audience`.", - "default": false - } - }, - "description": "Parameters used in the token exchange request." - }, - "cache": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "Whether to enable caching.", - "default": true - }, - "ttl": { - "type": "integer", - "description": "Cache ttl in seconds used when caching exchanged tokens, use it to override `conf.cache_ttl`. Token expiry will be used if shorter than this value." - } - }, - "description": "Cache support for token exchange" - }, - "subject_token_issuers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "conditions": { - "type": "object", - "properties": { - "has_scopes": { - "type": "array", - "items": { - "type": "string" - } - }, - "missing_scopes": { - "type": "array", - "items": { - "type": "string" - } - }, - "has_audience": { - "type": "array", - "items": { - "type": "string" - } - }, - "missing_audience": { - "type": "array", - "items": { - "type": "string" - } - } - }, - "description": "A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined." - }, - "issuer": { - "type": "string", - "description": "Tokens of whose iss claim matches this value will be exchanged." - } - }, - "required": [ - "issuer" - ] - }, - "minLength": 1, - "description": "Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged." - } - }, - "required": [ - "subject_token_issuers" - ], - "description": "Details on how to accept tokens from other identity providers." - }, - "groups_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "groups" - ] - }, - "token_post_args_client": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Pass extra arguments from the client to the OpenID-Connect policy. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with `scope` values, like this: `config.token_post_args_client=scope` In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint." + "description": "The downstream access token header." }, - "verify_claims": { + "require_proof_key_for_code_exchange": { "type": "boolean", - "description": "Verify tokens for standard claims.", - "default": true - }, - "client_auth": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ] - }, - "description": "The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication)." - }, - "roles_required": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." - }, - "introspection_post_args_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra post argument names passed to the introspection endpoint." + "description": "Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled)." }, - "userinfo_endpoint": { - "type": "string", - "description": "The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint." + "require_signed_request_object": { + "type": "boolean", + "description": "Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled)." }, - "session_request_headers": { + "consumer_by": { "type": "array", "items": { "type": "string", "enum": [ - "absolute-timeout", - "audience", + "custom_id", "id", - "idling-timeout", - "rolling-timeout", - "subject", - "timeout" + "username" ] }, - "description": "Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout request headers." - }, - "session_memcached_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "The memcached port.", - "default": 11211 - }, - "extra_jwks_uris": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "x-referenceable": true - }, - "description": "JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery)." - }, - "authorization_cookie_http_only": { - "type": "boolean", - "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", - "default": true - }, - "upstream_headers_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The upstream header names for the claim values." + "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.", + "default": [ + "custom_id", + "username" + ] }, "expose_error_code": { "type": "boolean", "description": "Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to `false` to disable.", "default": true }, - "upstream_user_info_header": { - "type": "string", - "description": "The upstream user info header." - }, - "consumer_optional": { - "type": "boolean", - "description": "Do not terminate the request if consumer mapping fails.", - "default": false - }, - "refresh_token_param_name": { - "type": "string", - "description": "The name of the parameter used to pass the refresh token." - }, - "jwks_endpoint": { - "type": "string", - "description": "Overrides the `jwks_uri` returned by discovery. Use when the IdP exposes a non-standard JWKS endpoint." - }, - "preserve_query_args": { - "type": "boolean", - "description": "With this parameter, you can preserve request query arguments even when doing authorization code flow.", - "default": false - }, - "session_cookie_http_only": { - "type": "boolean", - "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", - "default": true - }, - "downstream_refresh_token_header": { - "type": "string", - "description": "The downstream refresh token header." - }, - "logout_revoke_access_token": { - "type": "boolean", - "description": "Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.", - "default": true - }, - "cache_token_exchange": { - "type": "boolean", - "description": "Cache the legacy token exchange endpoint requests.", - "default": true - }, - "mtls_introspection_endpoint": { - "type": "string", - "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." - }, - "cluster_cache_strategy": { - "type": "string", - "enum": [ - "off", - "redis" - ], - "description": "The strategy to use for the cluster cache. If set, the policy will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.", - "default": "off" - }, - "authorization_cookie_domain": { - "type": "string", - "description": "The authorization cookie Domain flag." - }, - "downstream_headers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "header": { - "type": "string", - "description": "The name of the header." - }, - "path": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "The path of the header value." - } - }, - "required": [ - "header", - "path" - ] - }, - "description": "The downstream claim to header mappings." - }, - "cache_ttl_resurrect": { - "type": "number", - "description": "The resurrection ttl in seconds." - }, - "cache_tokens_salt": { - "type": "string", - "description": "Salt used for generating the cache key that is used for caching the token endpoint requests." - }, - "require_signed_request_object": { - "type": "boolean", - "description": "Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled)." - }, - "introspection_hint": { - "type": "string", - "description": "Introspection hint parameter value passed to the introspection endpoint.", - "default": "access_token" - }, - "session_secret": { - "type": "string", - "description": "The session secret.", - "x-referenceable": true, - "x-encrypted": true - }, - "session_memcached_prefix": { - "type": "string", - "description": "The memcached session key prefix." - }, - "consumer_by": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "custom_id", - "id", - "username" - ] - }, - "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.", - "default": [ - "custom_id", - "username" - ] - }, - "timeout": { - "type": "number", - "description": "Network IO timeout in milliseconds.", - "default": 10000 - }, - "token_post_args_values": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra post argument values passed to the token endpoint." - }, - "introspection_endpoint_auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ], - "description": "The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" - }, - "introspection_post_args_values": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra post argument values passed to the introspection endpoint." - }, - "http_proxy_authorization": { - "type": "string", - "description": "The HTTP proxy authorization.", - "x-referenceable": true - }, - "scopes_required": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." - }, - "upstream_refresh_token_header": { - "type": "string", - "description": "The upstream refresh token header." - }, - "disable_session": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "authorization_code", - "bearer", - "client_credentials", - "introspection", - "kong_oauth2", - "password", - "refresh_token", - "session", - "userinfo" - ] - }, - "description": "Disable issuing the session cookie with the specified grants." - }, - "scopes": { - "type": "array", - "items": { - "type": "string", - "x-referenceable": true - }, - "description": "The scopes passed to the authorization and token endpoints.", - "default": [ - "openid" - ] - }, - "domains": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The allowed values for the `hd` claim." - }, - "end_session_endpoint": { - "type": "string", - "description": "The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint." - }, - "login_action": { - "type": "string", - "enum": [ - "redirect", - "response", - "upstream" - ], - "description": "What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.", - "default": "upstream" - }, - "redirect_uri": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "description": "The redirect URI passed to the authorization and token endpoints." - }, - "session_remember_cookie_name": { - "type": "string", - "description": "Persistent session cookie name. Use with the `remember` configuration parameter.", - "default": "remember" - }, - "unauthorized_error_message": { - "type": "string", - "description": "The error message for the unauthorized requests (when not using the redirection).", - "default": "Unauthorized" - }, - "roles_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "roles" - ] - }, - "refresh_tokens": { - "type": "boolean", - "description": "Specifies whether the policy should try to refresh (soon to be) expired access tokens if the policy has a `refresh_token` available.", - "default": true - }, - "upstream_introspection_jwt_header": { - "type": "string", - "description": "The upstream introspection JWT header." - }, "cluster_cache_redis": { "type": "object", "properties": { - "connect_timeout": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "port": { "type": "integer", - "maximum": 2147483646, + "maximum": 65535, "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true }, - "read_timeout": { + "send_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, "sentinel_password": { "type": "string", "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, - "database": { + "connect_timeout": { "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, "keepalive_pool_size": { "type": "integer", @@ -1613,19 +1109,33 @@ "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true }, "sentinel_nodes": { "type": "array", @@ -1649,85 +1159,51 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, "cluster_max_redirections": { "type": "integer", "description": "Maximum retry attempts for redirection.", "default": 5 }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "host": { + "sentinel_master": { "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true }, - "password": { + "server_name": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true }, "cloud_authentication": { "type": "object", "properties": { - "aws_cache_name": { + "auth_provider": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_access_key_id": { + "aws_cache_name": { "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true }, "aws_secret_access_key": { "type": "string", @@ -1735,42 +1211,43 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_assume_role_arn": { - "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true - }, "aws_role_session_name": { "type": "string", "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-encrypted": true, + "x-referenceable": true + }, "azure_tenant_id": { "type": "string", "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, "aws_region": { "type": "string", "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "gcp_service_account_json": { + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_access_key_id": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, @@ -1783,76 +1260,681 @@ "azure_client_secret": { "type": "string", "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true } }, - "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + } + } + }, + "auth_methods": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "authorization_code", + "bearer", + "client_credentials", + "introspection", + "kong_oauth2", + "password", + "refresh_token", + "session", + "userinfo" + ] + }, + "description": "Types of credentials/grants to enable.", + "default": [ + "authorization_code", + "bearer", + "client_credentials", + "introspection", + "kong_oauth2", + "password", + "refresh_token", + "session", + "userinfo" + ] + }, + "introspection_post_args_client": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra post arguments passed from the client to the introspection endpoint." + }, + "userinfo_headers_values": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header values passed to the user info endpoint." + }, + "downstream_access_token_jwk_header": { + "type": "string", + "description": "The downstream access token JWK header." + }, + "login_tokens": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "access_token", + "id_token", + "introspection", + "refresh_token", + "tokens" + ] + }, + "description": "What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.", + "default": [ + "id_token" + ] + }, + "logout_methods": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "DELETE", + "GET", + "POST" + ] + }, + "description": "The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.", + "default": [ + "DELETE", + "POST" + ] + }, + "bearer_token_param_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "body", + "cookie", + "header", + "query" + ] + }, + "description": "Where to look for the bearer token: - `header`: search the `Authorization`, `access-token`, and `x-access-token` HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.", + "default": [ + "body", + "header", + "query" + ] + }, + "upstream_headers_claims": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The upstream header claims. Only top level claims are supported." + }, + "authorization_cookie_same_site": { + "type": "string", + "enum": [ + "Default", + "Lax", + "None", + "Strict" + ], + "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", + "default": "Default" + }, + "downstream_headers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "path": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "The path of the header value." + }, + "header": { + "type": "string", + "description": "The name of the header." + } + }, + "required": [ + "header", + "path" + ] + }, + "description": "The downstream claim to header mappings." + }, + "keepalive": { + "type": "boolean", + "description": "Use keepalive with the HTTP client.", + "default": true + }, + "login_redirect_uri": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "x-referenceable": true + }, + "description": "Where to redirect the client when `login_action` is set to `redirect`." + }, + "introspection_accept": { + "type": "string", + "enum": [ + "application/json", + "application/jwt", + "application/token-introspection+jwt" + ], + "description": "The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).", + "default": "application/json" + }, + "userinfo_query_args_values": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra query argument values passed to the user info endpoint." + }, + "password_param_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ] + }, + "description": "Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] + }, + "logout_revoke": { + "type": "boolean", + "description": "Revoke tokens as part of the logout.\n\nFor more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.", + "default": false + }, + "enable_hs_signatures": { + "type": "boolean", + "description": "Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).", + "default": false + }, + "unauthorized_redirect_uri": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." + }, + "description": "Where to redirect the client on unauthorized requests." + }, + "verify_parameters": { + "type": "boolean", + "description": "Verify policy configuration against discovery.", + "default": false + }, + "audience_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "aud" + ] + }, + "introspect_jwt_tokens": { + "type": "boolean", + "description": "Specifies whether to introspect the JWT access tokens (can be used to check for revocations).", + "default": false + }, + "session_secret": { + "type": "string", + "description": "The session secret.", + "x-referenceable": true, + "x-encrypted": true + }, + "client_credentials_param_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ] + }, + "description": "Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] + }, + "authenticated_groups_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The claim that contains authenticated groups. This setting can be used together with ACL policy, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload." + }, + "preserve_query_args": { + "type": "boolean", + "description": "With this parameter, you can preserve request query arguments even when doing authorization code flow.", + "default": false + }, + "session_hash_storage_key": { + "type": "boolean", + "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.", + "default": false + }, + "timeout": { + "type": "number", + "description": "Network IO timeout in milliseconds.", + "default": 10000 + }, + "pushed_authorization_request_endpoint_auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" + ], + "description": "The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" + }, + "token_exchange_endpoint": { + "type": "string", + "description": "Endpoint used to perform the legacy token exchange." + }, + "upstream_access_token_jwk_header": { + "type": "string", + "description": "The upstream access token JWK header." + }, + "consumer_optional": { + "type": "boolean", + "description": "Do not terminate the request if consumer mapping fails.", + "default": false + }, + "cache_ttl": { + "type": "number", + "description": "The default cache ttl in seconds that is used in case the cached object does not specify the expiry.", + "default": 3600 + }, + "session_cookie_path": { + "type": "string", + "description": "The session cookie Path flag.", + "default": "/" + }, + "upstream_user_info_jwt_header": { + "type": "string", + "description": "The upstream user info JWT header (in case the user info returns a JWT response)." + }, + "cache_ttl_min": { + "type": "number", + "description": "The minimum cache ttl in seconds (enforced)." + }, + "mtls_revocation_endpoint": { + "type": "string", + "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." + }, + "max_age": { + "type": "number", + "description": "The maximum age (in seconds) compared to the `auth_time` claim." + }, + "authorization_rolling_timeout": { + "type": "number", + "description": "Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", + "default": 600 + }, + "token_headers_prefix": { + "type": "string", + "description": "Add a prefix to the token endpoint response headers before forwarding them to the downstream client." + }, + "session_rolling_timeout": { + "type": "number", + "description": "Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", + "default": 3600 + }, + "cache_tokens_salt": { + "type": "string", + "description": "Salt used for generating the cache key that is used for caching the token endpoint requests." + }, + "proof_of_possession_auth_methods_validation": { + "type": "boolean", + "description": "If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.", + "default": true + }, + "using_pseudo_issuer": { + "type": "boolean", + "description": "If the policy uses a pseudo issuer. When set to true, the policy will not discover the configuration from the issuer URL specified with `config.issuer`.", + "default": false + }, + "response_mode": { + "type": "string", + "enum": [ + "form_post", + "form_post.jwt", + "fragment", + "fragment.jwt", + "jwt", + "query", + "query.jwt" + ], + "description": "Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the policy itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.", + "default": "query" + }, + "principals": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "When true, query Kong Identity to map a Principal after token verification.", + "default": false + }, + "directory": { + "type": "string", + "description": "The Kong Identity directory instance to look up against.", + "default": "default" + }, + "principal_by": { + "type": "string", + "minLength": 1, + "description": "Custom identity name for a type=custom Kong Identity lookup. When absent and principal_claim is set, an OIDC lookup is performed using principal_claim as the claim name instead of 'sub'." + }, + "principal_claim": { + "type": "array", + "items": { + "type": "string", + "minLength": 1 + }, + "minLength": 1, + "description": "Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'." }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + "match_consumer": { + "type": "boolean", + "description": "If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by.", + "default": true + }, + "match_consumer_groups": { + "type": "boolean", + "description": "If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumer_groups_claim.", + "default": true + }, + "error_on_miss": { + "type": "boolean", + "description": "When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set.", + "default": true } - } + }, + "description": "Configuration for Kong Identity principal hydration after token verification." }, - "max_age": { + "downstream_session_id_header": { + "type": "string", + "description": "The downstream session id header." + }, + "disable_session": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "authorization_code", + "bearer", + "client_credentials", + "introspection", + "kong_oauth2", + "password", + "refresh_token", + "session", + "userinfo" + ] + }, + "description": "Disable issuing the session cookie with the specified grants." + }, + "by_username_ignore_case": { + "type": "boolean", + "description": "If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.", + "default": false + }, + "dpop_use_nonce": { + "type": "boolean", + "description": "Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.", + "default": false + }, + "http_proxy": { + "type": "string", + "description": "The HTTP proxy." + }, + "jwks_endpoint": { + "type": "string", + "description": "Overrides the `jwks_uri` returned by discovery. Use when the IdP exposes a non-standard JWKS endpoint." + }, + "forbidden_error_message": { + "type": "string", + "description": "The error message for the forbidden requests (when not using the redirection).", + "default": "Forbidden" + }, + "refresh_token_param_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ] + }, + "description": "Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] + }, + "verify_nonce": { + "type": "boolean", + "description": "Verify nonce on authorization code flow.", + "default": true + }, + "ignore_signature": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "authorization_code", + "client_credentials", + "introspection", + "password", + "refresh_token", + "session", + "userinfo" + ] + }, + "description": "Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.", + "default": [] + }, + "cache_ttl_max": { "type": "number", - "description": "The maximum age (in seconds) compared to the `auth_time` claim." + "description": "The maximum cache ttl in seconds (enforced)." }, - "introspection_post_args_client": { + "response_type": { "type": "array", "items": { "type": "string" }, - "description": "Extra post arguments passed from the client to the introspection endpoint." + "description": "The response type passed to the authorization endpoint.", + "default": [ + "code" + ] }, - "userinfo_headers_values": { + "verify_claims": { + "type": "boolean", + "description": "Verify tokens for standard claims.", + "default": true + }, + "cluster_cache_strategy": { + "type": "string", + "enum": [ + "off", + "redis" + ], + "description": "The strategy to use for the cluster cache. If set, the policy will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.", + "default": "off" + }, + "unauthorized_error_message": { + "type": "string", + "description": "The error message for the unauthorized requests (when not using the redirection).", + "default": "Unauthorized" + }, + "jwt_session_claim": { + "type": "string", + "description": "The claim to match against the JWT session cookie.", + "default": "sid" + }, + "hide_credentials": { + "type": "boolean", + "description": "Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the policy will remove those that were used for successful authentication.", + "default": true + }, + "session_cookie_name": { + "type": "string", + "description": "The session cookie name.", + "default": "session" + }, + "client_arg": { + "type": "string", + "description": "The client to use for this request (the selection is made with a request parameter with the same name).", + "default": "client_id" + }, + "authorization_cookie_path": { + "type": "string", + "description": "The authorization cookie Path flag.", + "default": "/" + }, + "proof_of_possession_dpop": { + "type": "string", + "enum": [ + "off", + "optional", + "strict" + ], + "description": "Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.", + "default": "off" + }, + "roles_required": { "type": "array", "items": { "type": "string" }, - "description": "Extra header values passed to the user info endpoint." + "description": "The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." }, - "consumer_groups_claim": { + "token_headers_values": { "type": "array", "items": { "type": "string" }, - "description": "The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload." + "description": "Extra header values passed to the token endpoint." + }, + "dpop_proof_lifetime": { + "type": "number", + "description": "Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.", + "default": 300 + }, + "groups_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "groups" + ] + }, + "introspection_hint": { + "type": "string", + "description": "Introspection hint parameter value passed to the introspection endpoint.", + "default": "access_token" + }, + "consumer_groups_optional": { + "type": "boolean", + "description": "Do not terminate the request if consumer groups mapping fails.", + "default": false + }, + "https_proxy": { + "type": "string", + "description": "The HTTPS proxy." + }, + "upstream_session_id_header": { + "type": "string", + "description": "The upstream session id header." }, "tls_client_auth_ssl_verify": { "type": "boolean", "description": "Verify identity provider server certificate during mTLS client authentication.", "default": true }, + "authorization_query_args_values": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra query argument values passed to the authorization endpoint." + }, + "http_version": { + "type": "number", + "description": "The HTTP version used for the requests by this policy: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.", + "default": 1.1 + }, "client_jwk": { "type": "array", "items": { "type": "object", "properties": { - "x5t#S256": { + "x5u": { "type": "string" }, - "e": { + "x5t#S256": { "type": "string" }, - "qi": { + "k": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "key_ops": { - "type": "array", - "items": { - "type": "string" - } - }, "crv": { "type": "string" }, - "n": { + "e": { + "type": "string" + }, + "kid": { + "type": "string" + }, + "x5t": { + "type": "string" + }, + "x": { "type": "string" }, "d": { @@ -1865,17 +1947,12 @@ "x-referenceable": true, "x-encrypted": true }, - "q": { - "type": "string", - "x-referenceable": true, - "x-encrypted": true - }, - "r": { + "dp": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "t": { + "oth": { "type": "string", "x-referenceable": true, "x-encrypted": true @@ -1883,172 +1960,207 @@ "y": { "type": "string" }, - "k": { - "type": "string", - "x-referenceable": true, - "x-encrypted": true - }, - "x": { + "n": { "type": "string" }, - "dp": { - "type": "string", - "x-encrypted": true, - "x-referenceable": true - }, - "dq": { + "r": { "type": "string", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, - "oth": { + "t": { "type": "string", "x-encrypted": true, "x-referenceable": true }, - "kty": { - "type": "string" - }, - "use": { - "type": "string" - }, - "kid": { - "type": "string" - }, - "issuer": { - "type": "string" + "key_ops": { + "type": "array", + "items": { + "type": "string" + } }, "alg": { "type": "string" }, - "x5u": { - "type": "string" - }, "x5c": { "type": "array", "items": { "type": "string" } }, - "x5t": { + "q": { + "type": "string", + "x-referenceable": true, + "x-encrypted": true + }, + "dq": { + "type": "string", + "x-referenceable": true, + "x-encrypted": true + }, + "qi": { + "type": "string", + "x-referenceable": true, + "x-encrypted": true + }, + "issuer": { + "type": "string" + }, + "kty": { + "type": "string" + }, + "use": { "type": "string" } } }, "description": "The JWK used for the private_key_jwt authentication." }, - "forbidden_destroy_session": { - "type": "boolean", - "description": "Destroy any active session for the forbidden requests.", - "default": true + "pushed_authorization_request_endpoint": { + "type": "string", + "description": "The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint." }, - "authorization_cookie_name": { + "downstream_user_info_header": { "type": "string", - "description": "The authorization cookie name.", - "default": "authorization" + "description": "The downstream user info header." }, - "require_proof_key_for_code_exchange": { + "cache_token_exchange": { "type": "boolean", - "description": "Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled)." + "description": "Cache the legacy token exchange endpoint requests.", + "default": true }, - "authorization_endpoint": { + "issuers_allowed": { + "type": "array", + "items": { + "type": "string", + "x-referenceable": true + }, + "description": "The issuers allowed to be present in the tokens (`iss` claim)." + }, + "session_remember_rolling_timeout": { + "type": "number", + "description": "Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.", + "default": 604800 + }, + "session_idling_timeout": { + "type": "number", + "description": "Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.", + "default": 900 + }, + "bearer_token_cookie_name": { "type": "string", - "description": "The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint." + "description": "The name of the cookie in which the bearer token is passed." }, - "session_cookie_domain": { + "upstream_access_token_header": { "type": "string", - "description": "The session cookie Domain flag." + "description": "The upstream access token header.", + "default": "authorization:bearer" }, - "session_storage": { + "client_auth": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" + ] + }, + "description": "The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication)." + }, + "session_response_headers": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "absolute-timeout", + "audience", + "id", + "idling-timeout", + "rolling-timeout", + "subject", + "timeout" + ] + }, + "description": "Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout response headers." + }, + "upstream_refresh_token_header": { "type": "string", - "enum": [ - "cookie", - "memcache", - "memcached", - "redis" - ], - "description": "The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.", - "default": "cookie" + "description": "The upstream refresh token header." }, - "session_store_metadata": { + "require_pushed_authorization_requests": { "type": "boolean", - "description": "Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.", - "default": false + "description": "Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`)." }, - "run_on_preflight": { - "type": "boolean", - "description": "Specifies whether to run this policy on pre-flight (`OPTIONS`) requests.", - "default": true + "token_endpoint_auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" + ], + "description": "The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" }, - "keepalive": { - "type": "boolean", - "description": "Use keepalive with the HTTP client.", - "default": true + "userinfo_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header names passed to the user info endpoint." }, - "token_cache_key_include_scope": { + "reverify": { "type": "boolean", - "description": "Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.", + "description": "Specifies whether to always verify tokens stored in the session.", "default": false }, - "upstream_access_token_header": { + "cache_ttl_neg": { + "type": "number", + "description": "The negative cache ttl in seconds." + }, + "session_memcached_prefix": { "type": "string", - "description": "The upstream access token header.", - "default": "authorization:bearer" + "description": "The memcached session key prefix." }, - "client_alg": { + "upstream_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The upstream header names for the claim values." + }, + "login_methods": { "type": "array", "items": { "type": "string", "enum": [ - "ES256", - "ES384", - "ES512", - "EdDSA", - "HS256", - "HS384", - "HS512", - "PS256", - "PS384", - "PS512", - "RS256", - "RS384", - "RS512" + "authorization_code", + "bearer", + "client_credentials", + "introspection", + "kong_oauth2", + "password", + "refresh_token", + "session", + "userinfo" ] }, - "description": "The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication." - }, - "session_remember": { - "type": "boolean", - "description": "Enables or disables persistent sessions.", - "default": false - }, - "session_remember_absolute_timeout": { - "type": "number", - "description": "Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", - "default": 2592000 - }, - "logout_uri_suffix": { - "type": "string", - "description": "The request URI suffix that activates the logout." - }, - "verify_nonce": { - "type": "boolean", - "description": "Verify nonce on authorization code flow.", - "default": true - }, - "unauthorized_destroy_session": { - "type": "boolean", - "description": "Destroy any active session for the unauthorized requests.", - "default": true + "description": "Enable login functionality with specified grants.", + "default": [ + "authorization_code" + ] }, - "token_exchange_endpoint": { + "revocation_token_param_name": { "type": "string", - "description": "Endpoint used to perform the legacy token exchange." - }, - "http_version": { - "type": "number", - "description": "The HTTP version used for the requests by this policy: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.", - "default": 1.1 + "description": "Designate token's parameter name for revocation.", + "default": "token" }, "groups_required": { "type": "array", @@ -2057,164 +2169,181 @@ }, "description": "The groups (`groups_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." }, - "introspection_check_active": { - "type": "boolean", - "description": "Check that the introspection response has an `active` claim with a value of `true`.", - "default": true - }, - "session_rolling_timeout": { - "type": "number", - "description": "Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", - "default": 3600 + "introspection_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header names passed to the introspection endpoint." }, - "downstream_user_info_jwt_header": { + "session_audience": { "type": "string", - "description": "The downstream user info JWT header (in case the user info returns a JWT response)." + "description": "The session audience, which is the intended target application. For example `\"my-application\"`.", + "default": "default" }, - "token_endpoint": { + "session_hash_subject": { + "type": "boolean", + "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.", + "default": false + }, + "downstream_introspection_jwt_header": { "type": "string", - "description": "The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint." + "description": "The downstream introspection JWT header." }, - "principals": { + "cache_ttl_resurrect": { + "type": "number", + "description": "The resurrection ttl in seconds." + }, + "protected_resource_metadata": { "type": "object", "properties": { - "enabled": { - "type": "boolean", - "description": "When true, query Kong Identity to map a Principal after token verification.", - "default": false - }, - "directory": { + "metadata_endpoint": { "type": "string", - "description": "The Kong Identity directory instance to look up against.", - "default": "default" + "description": "Override the well-known metadata endpoint path. Defaults to the path component of resource with /.well-known/oauth-protected-resource appended." }, - "principal_by": { + "resource": { "type": "string", - "minLength": 1, - "description": "Custom identity name for a type=custom Kong Identity lookup. When absent and principal_claim is set, an OIDC lookup is performed using principal_claim as the claim name instead of 'sub'." + "description": "The URI of the protected resource. Used as the resource field in the RFC 9728 metadata document and to derive the well-known endpoint path." }, - "principal_claim": { + "authorization_servers": { "type": "array", "items": { "type": "string", - "minLength": 1 + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." }, "minLength": 1, - "description": "Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'." - }, - "match_consumer": { - "type": "boolean", - "description": "If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by.", - "default": true - }, - "match_consumer_groups": { - "type": "boolean", - "description": "If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumer_groups_claim.", - "default": true + "description": "List of authorization server issuer URIs to advertise in the RFC 9728 metadata document." }, - "error_on_miss": { - "type": "boolean", - "description": "When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set.", - "default": true + "scopes_supported": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "Scopes supported by this protected resource. Included in the RFC 9728 metadata document and in the scope attribute of WWW-Authenticate challenge headers on 401 responses." } }, - "description": "Configuration for Kong Identity principal hydration after token verification." - }, - "http_proxy": { - "type": "string", - "description": "The HTTP proxy." - }, - "mtls_token_endpoint": { - "type": "string", - "description": "Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." + "required": [ + "authorization_servers", + "resource" + ], + "description": "When configured, the policy advertises this API as an OAuth 2.0 protected resource per RFC 9728. It serves a discovery document at the well-known URI and includes resource_metadata in WWW-Authenticate challenge headers." }, - "authorization_cookie_secure": { - "type": "boolean", - "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." + "client_secret": { + "type": "array", + "items": { + "type": "string", + "x-referenceable": true + }, + "description": "The client secret.", + "x-encrypted": true }, - "credential_claim": { + "introspection_post_args_values": { "type": "array", "items": { "type": "string" }, - "description": "The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting policy), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "sub" - ] + "description": "Extra post argument values passed to the introspection endpoint." }, - "enable_hs_signatures": { + "token_cache_key_include_scope": { "type": "boolean", - "description": "Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).", + "description": "Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.", "default": false }, - "upstream_access_token_jwk_header": { - "type": "string", - "description": "The upstream access token JWK header." + "session_absolute_timeout": { + "type": "number", + "description": "Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", + "default": 86400 }, - "consumer_claims": { - "type": "array", - "items": { - "type": "array", - "items": { - "type": "string" - }, - "description": "A path of strings representing the location of the claim in a nested object. For example, to map to `user.info.id`, set `[ \"user\", \"info\", \"id\" ]`." - }, - "description": "The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used." + "cache_tokens": { + "type": "boolean", + "description": "Cache the token endpoint requests.", + "default": true }, - "using_pseudo_issuer": { + "display_errors": { "type": "boolean", - "description": "If the policy uses a pseudo issuer. When set to true, the policy will not discover the configuration from the issuer URL specified with `config.issuer`.", + "description": "Display errors on failure responses.", "default": false }, - "client_id": { + "redirect_uri": { "type": "array", "items": { "type": "string", - "x-referenceable": true + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." }, - "description": "The client id(s) that the policy uses when it calls authenticated endpoints on the identity provider.", - "x-encrypted": true + "description": "The redirect URI passed to the authorization and token endpoints." }, - "pushed_authorization_request_endpoint": { - "type": "string", - "description": "The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint." + "audience": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The audience passed to the authorization endpoint." }, - "session_cookie_same_site": { - "type": "string", - "enum": [ - "Default", - "Lax", - "None", - "Strict" - ], - "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", - "default": "Lax" + "token_headers_grants": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "authorization_code", + "client_credentials", + "password", + "refresh_token" + ] + }, + "description": "Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant." }, - "session_memcached_host": { - "type": "string", - "description": "The memcached host.", - "default": "127.0.0.1" + "discovery_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header names passed to the discovery endpoint." }, - "bearer_token_param_type": { + "session_bind": { "type": "array", "items": { "type": "string", "enum": [ - "body", - "cookie", - "header", - "query" + "ip", + "scheme", + "user-agent" ] }, - "description": "Where to look for the bearer token: - `header`: search the `Authorization`, `access-token`, and `x-access-token` HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.", - "default": [ - "body", - "header", - "query" - ] + "description": "Bind the session to data acquired from the HTTP request or connection." + }, + "token_endpoint": { + "type": "string", + "description": "The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint." + }, + "downstream_id_token_jwk_header": { + "type": "string", + "description": "The downstream id token JWK header." + }, + "session_storage": { + "type": "string", + "enum": [ + "cookie", + "memcache", + "memcached", + "redis" + ], + "description": "The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.", + "default": "cookie" + }, + "cache_user_info": { + "type": "boolean", + "description": "Cache the user info requests.", + "default": true + }, + "token_post_args_client": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Pass extra arguments from the client to the OpenID-Connect policy. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with `scope` values, like this: `config.token_post_args_client=scope` In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint." }, - "pushed_authorization_request_endpoint_auth_method": { + "introspection_endpoint_auth_method": { "type": "string", "enum": [ "client_secret_basic", @@ -2225,144 +2354,125 @@ "self_signed_tls_client_auth", "tls_client_auth" ], - "description": "The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" - }, - "cache_tokens": { - "type": "boolean", - "description": "Cache the token endpoint requests.", - "default": true + "description": "The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" }, - "claims_forbidden": { + "introspection_post_args_client_headers": { "type": "array", "items": { "type": "string" }, - "description": "If given, these claims are forbidden in the token payload." + "description": "Extra post arguments passed from the client headers to the introspection endpoint." }, - "token_headers_client": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra headers passed from the client to the token endpoint." + "end_session_endpoint": { + "type": "string", + "description": "The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint." }, - "password_param_type": { + "ssl_verify": { + "type": "boolean", + "description": "Verify identity provider server certificate. If set to `true`, the policy uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.", + "default": true + }, + "client_alg": { "type": "array", "items": { "type": "string", "enum": [ - "body", - "header", - "query" + "ES256", + "ES384", + "ES512", + "EdDSA", + "HS256", + "HS384", + "HS512", + "PS256", + "PS384", + "PS512", + "RS256", + "RS384", + "RS512" ] }, - "description": "Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", - "default": [ - "body", - "header", - "query" - ] - }, - "reverify": { - "type": "boolean", - "description": "Specifies whether to always verify tokens stored in the session.", - "default": false - }, - "id_token_param_name": { - "type": "string", - "description": "The name of the parameter used to pass the id token." + "description": "The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication." }, - "mtls_revocation_endpoint": { + "userinfo_endpoint": { "type": "string", - "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." + "description": "The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint." }, - "discovery_headers_values": { + "consumer_claims": { "type": "array", "items": { - "type": "string" + "type": "array", + "items": { + "type": "string" + }, + "description": "A path of strings representing the location of the claim in a nested object. For example, to map to `user.info.id`, set `[ \"user\", \"info\", \"id\" ]`." }, - "description": "Extra header values passed to the discovery endpoint." - }, - "authorization_rolling_timeout": { - "type": "number", - "description": "Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", - "default": 600 + "description": "The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used." }, - "authorization_cookie_path": { - "type": "string", - "description": "The authorization cookie Path flag.", - "default": "/" + "introspection_headers_values": { + "type": "array", + "items": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra header values passed to the introspection endpoint.", + "x-encrypted": true }, - "introspect_jwt_tokens": { + "session_remember": { "type": "boolean", - "description": "Specifies whether to introspect the JWT access tokens (can be used to check for revocations).", + "description": "Enables or disables persistent sessions.", "default": false }, - "discovery_headers_names": { + "login_action": { + "type": "string", + "enum": [ + "redirect", + "response", + "upstream" + ], + "description": "What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.", + "default": "upstream" + }, + "claims_forbidden": { "type": "array", "items": { "type": "string" }, - "description": "Extra header names passed to the discovery endpoint." + "description": "If given, these claims are forbidden in the token payload." }, - "introspection_accept": { + "authorization_endpoint": { "type": "string", - "enum": [ - "application/json", - "application/jwt", - "application/token-introspection+jwt" - ], - "description": "The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).", - "default": "application/json" + "description": "The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint." }, - "session_memcached_ssl": { + "introspection_check_active": { "type": "boolean", - "description": "If set to true, uses SSL to connect to memcached" + "description": "Check that the introspection response has an `active` claim with a value of `true`.", + "default": true }, - "downstream_id_token_jwk_header": { - "type": "string", - "description": "The downstream id token JWK header." + "search_user_info": { + "type": "boolean", + "description": "Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.", + "default": false }, - "scopes_claim": { + "token_headers_replay": { "type": "array", "items": { "type": "string" }, - "description": "The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "scope" - ] + "description": "The names of token endpoint response headers to forward to the downstream client." }, - "audience_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "aud" - ] + "mtls_introspection_endpoint": { + "type": "string", + "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." }, - "require_pushed_authorization_requests": { - "type": "boolean", - "description": "Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`)." + "https_proxy_authorization": { + "type": "string", + "description": "The HTTPS proxy authorization.", + "x-referenceable": true }, - "client_credentials_param_type": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "body", - "header", - "query" - ] - }, - "description": "Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.", - "default": [ - "body", - "header", - "query" - ] + "no_proxy": { + "type": "string", + "description": "Do not use proxy with these hosts." } }, "required": [ @@ -2376,48 +2486,6 @@ ] }, "description": "List of openid_connect strategies." - }, - "key_auth": { - "type": "array", - "items": { - "type": "object", - "properties": { - "strategy_id": { - "type": "string", - "description": "The strategy id the config is tied to." - }, - "principals": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "When true, fetch application principal from Kong Identity after authentication", - "default": false - } - } - }, - "config": { - "type": "object", - "properties": { - "key_names": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing an HTTP header name." - }, - "description": "The names of the headers containing the API key. You can specify multiple header names.", - "default": [ - "apikey" - ] - } - } - } - }, - "required": [ - "strategy_id" - ] - }, - "description": "List of key_auth strategies." } }, "description": "The map of v2 strategies.", @@ -2433,45 +2501,12 @@ "default": [ "apikey" ] - }, - "auth_type": { - "type": "string", - "enum": [ - "key-auth", - "openid-connect", - "v2-strategies" - ], - "description": "The type of authentication to be performed. Possible values are: 'openid-connect', 'key-auth', 'v2-strategies'.", - "default": "openid-connect" - }, - "scope": { - "type": "string", - "description": "The unique scope identifier for the policy configuration." } }, "required": [ "scope" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/LdapAuth.json b/app/_schemas/ai-gateway/policies/LdapAuth.json index 8ddedf127e1..3932c430c2c 100644 --- a/app/_schemas/ai-gateway/policies/LdapAuth.json +++ b/app/_schemas/ai-gateway/policies/LdapAuth.json @@ -1,45 +1,60 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "model": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "Custom type for representing a foreign key with a null value allowed.", + "x-foreign": true + }, "config": { "type": "object", "properties": { - "cache_ttl": { - "type": "number", - "description": "Cache expiry time in seconds.", - "default": 60 - }, - "hide_credentials": { - "type": "boolean", - "description": "An optional boolean value telling the policy to hide the credential to the upstream server. It will be removed by Kong before proxying the request.", - "default": true - }, - "keepalive": { - "type": "number", - "description": "An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.", - "default": 60000 - }, - "realm": { - "type": "string", - "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." - }, - "ldap_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, "verify_ldap_host": { "type": "boolean", "description": "Set to `true` to authenticate LDAP server. The server certificate will be verified according to the CA certificates specified by the `lua_ssl_trusted_certificate` directive.", "default": true }, - "base_dn": { + "attribute": { "type": "string", - "description": "Base DN as the starting point for the search; e.g., dc=example,dc=com" + "description": "Attribute to be used to search the user; e.g. cn" }, "timeout": { "type": "number", "description": "An optional timeout in milliseconds when waiting for connection with LDAP server.", "default": 10000 }, + "keepalive": { + "type": "number", + "description": "An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.", + "default": 60000 + }, "anonymous": { "type": "string", "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`." @@ -49,6 +64,14 @@ "description": "An optional string to use as part of the Authorization header", "default": "ldap" }, + "realm": { + "type": "string", + "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." + }, + "ldap_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, "ldap_port": { "type": "integer", "maximum": 65535, @@ -56,19 +79,29 @@ "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 389 }, - "ldaps": { - "type": "boolean", - "description": "Set to `true` to connect using the LDAPS protocol (LDAP over TLS). When `ldaps` is configured, you must use port 636. If the `ldap` setting is enabled, ensure the `start_tls` setting is disabled.", - "default": false - }, "start_tls": { "type": "boolean", "description": "Set it to `true` to issue StartTLS (Transport Layer Security) extended operation over `ldap` connection. If the `start_tls` setting is enabled, ensure the `ldaps` setting is disabled.", "default": false }, - "attribute": { + "base_dn": { "type": "string", - "description": "Attribute to be used to search the user; e.g. cn" + "description": "Base DN as the starting point for the search; e.g., dc=example,dc=com" + }, + "cache_ttl": { + "type": "number", + "description": "Cache expiry time in seconds.", + "default": 60 + }, + "hide_credentials": { + "type": "boolean", + "description": "An optional boolean value telling the policy to hide the credential to the upstream server. It will be removed by Kong before proxying the request.", + "default": true + }, + "ldaps": { + "type": "boolean", + "description": "Set to `true` to connect using the LDAPS protocol (LDAP over TLS). When `ldaps` is configured, you must use port 636. If the `ldap` setting is enabled, ensure the `start_tls` setting is disabled.", + "default": false } }, "required": [ @@ -77,39 +110,6 @@ "ldap_host" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "model": { - "type": "object", - "properties": { - "id": { - "type": "string" - } - }, - "description": "Custom type for representing a foreign key with a null value allowed.", - "x-foreign": true - }, "service": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/LdapAuthAdvanced.json b/app/_schemas/ai-gateway/policies/LdapAuthAdvanced.json index 94c1dd3cacc..77bc98384e4 100644 --- a/app/_schemas/ai-gateway/policies/LdapAuthAdvanced.json +++ b/app/_schemas/ai-gateway/policies/LdapAuthAdvanced.json @@ -1,5 +1,28 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, "model": { "type": "object", "properties": { @@ -13,65 +36,15 @@ "config": { "type": "object", "properties": { - "group_name_attribute": { - "type": "string", - "description": "Sets the attribute holding the name of a group, typically called `name` (in Active Directory) or `cn` (in OpenLDAP). This field is case-insensitive." - }, - "log_search_results": { - "type": "boolean", - "description": "Displays all the LDAP search results received from the LDAP server for debugging purposes. Not recommended to be enabled in a production environment.", - "default": false - }, - "groups_required": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The groups required to be present in the LDAP search result for successful authorization. This config parameter works in both **AND** / **OR** cases. - When `[\"group1 group2\"]` are in the same array indices, both `group1` AND `group2` need to be present in the LDAP search result. - When `[\"group1\", \"group2\"]` are in different array indices, either `group1` OR `group2` need to be present in the LDAP search result." - }, - "ldap_port": { - "type": "number", - "description": "TCP port where the LDAP server is listening. 389 is the default port for non-SSL LDAP and AD. 636 is the port required for SSL LDAP and AD. If `ldaps` is configured, you must use port 636.", - "default": 389 - }, - "attribute": { - "type": "string", - "description": "Attribute to be used to search the user; e.g., \"cn\"." - }, - "cache_ttl": { - "type": "number", - "description": "Cache expiry time in seconds.", - "default": 60 - }, - "hide_credentials": { - "type": "boolean", - "description": "An optional boolean value telling the policy to hide the credential to the upstream server. It will be removed by Kong before proxying the request.", - "default": true - }, - "group_member_attribute": { - "type": "string", - "description": "Sets the attribute holding the members of the LDAP group. This field is case-sensitive.", - "default": "memberOf" - }, - "realm": { - "type": "string", - "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." - }, - "ldap_password": { - "type": "string", - "description": "The password to the LDAP server.", - "x-encrypted": true, - "x-referenceable": true - }, "verify_ldap_host": { "type": "boolean", "description": "Set to `true` to authenticate LDAP server. The server certificate will be verified according to the CA certificates specified by the `lua_ssl_trusted_certificate` directive.", "default": true }, - "keepalive": { + "timeout": { "type": "number", - "description": "An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.", - "default": 60000 + "description": "An optional timeout in milliseconds when waiting for connection with LDAP server.", + "default": 10000 }, "consumer_by": { "type": "array", @@ -88,32 +61,39 @@ "username" ] }, - "ldap_host": { - "type": "string", - "description": "Host on which the LDAP server is running." + "log_search_results": { + "type": "boolean", + "description": "Displays all the LDAP search results received from the LDAP server for debugging purposes. Not recommended to be enabled in a production environment.", + "default": false }, "bind_dn": { "type": "string", "description": "The DN to bind to. Used to perform LDAP search of user. This `bind_dn` should have permissions to search for the user being authenticated.", "x-referenceable": true }, - "base_dn": { + "attribute": { "type": "string", - "description": "Base DN as the starting point for the search; e.g., 'dc=example,dc=com'." + "description": "Attribute to be used to search the user; e.g., \"cn\"." }, - "timeout": { + "cache_ttl": { "type": "number", - "description": "An optional timeout in milliseconds when waiting for connection with LDAP server.", - "default": 10000 + "description": "Cache expiry time in seconds.", + "default": 60 + }, + "header_type": { + "type": "string", + "description": "An optional string to use as part of the Authorization header. By default, a valid Authorization header looks like this: `Authorization: ldap base64(username:password)`. If `header_type` is set to \"basic\", then the Authorization header would be `Authorization: basic base64(username:password)`. Note that `header_type` can take any string, not just `'ldap'` and `'basic'`.", + "default": "ldap" }, "consumer_optional": { "type": "boolean", "description": "Whether consumer mapping is optional. If `consumer_optional=true`, the policy will not attempt to associate a consumer with the LDAP authenticated user.", "default": false }, - "group_base_dn": { + "group_member_attribute": { "type": "string", - "description": "Sets a distinguished name (DN) for the entry where LDAP searches for groups begin. This field is case-insensitive.',dc=com'." + "description": "Sets the attribute holding the members of the LDAP group. This field is case-sensitive.", + "default": "memberOf" }, "ldaps": { "type": "boolean", @@ -125,15 +105,58 @@ "description": "Set it to `true` to issue StartTLS (Transport Layer Security) extended operation over `ldap` connection. If the `start_tls` setting is enabled, ensure the `ldaps` setting is disabled.", "default": false }, + "hide_credentials": { + "type": "boolean", + "description": "An optional boolean value telling the policy to hide the credential to the upstream server. It will be removed by Kong before proxying the request.", + "default": true + }, + "group_base_dn": { + "type": "string", + "description": "Sets a distinguished name (DN) for the entry where LDAP searches for groups begin. This field is case-insensitive.',dc=com'." + }, + "group_name_attribute": { + "type": "string", + "description": "Sets the attribute holding the name of a group, typically called `name` (in Active Directory) or `cn` (in OpenLDAP). This field is case-insensitive." + }, + "groups_required": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The groups required to be present in the LDAP search result for successful authorization. This config parameter works in both **AND** / **OR** cases. - When `[\"group1 group2\"]` are in the same array indices, both `group1` AND `group2` need to be present in the LDAP search result. - When `[\"group1\", \"group2\"]` are in different array indices, either `group1` OR `group2` need to be present in the LDAP search result." + }, + "ldap_host": { + "type": "string", + "description": "Host on which the LDAP server is running." + }, + "ldap_port": { + "type": "number", + "description": "TCP port where the LDAP server is listening. 389 is the default port for non-SSL LDAP and AD. 636 is the port required for SSL LDAP and AD. If `ldaps` is configured, you must use port 636.", + "default": 389 + }, + "base_dn": { + "type": "string", + "description": "Base DN as the starting point for the search; e.g., 'dc=example,dc=com'." + }, + "keepalive": { + "type": "number", + "description": "An optional value in milliseconds that defines how long an idle connection to LDAP server will live before being closed.", + "default": 60000 + }, "anonymous": { "type": "string", "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.", "default": "" }, - "header_type": { + "realm": { "type": "string", - "description": "An optional string to use as part of the Authorization header. By default, a valid Authorization header looks like this: `Authorization: ldap base64(username:password)`. If `header_type` is set to \"basic\", then the Authorization header would be `Authorization: basic base64(username:password)`. Note that `header_type` can take any string, not just `'ldap'` and `'basic'`.", - "default": "ldap" + "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." + }, + "ldap_password": { + "type": "string", + "description": "The password to the LDAP server.", + "x-referenceable": true, + "x-encrypted": true } }, "required": [ @@ -142,29 +165,6 @@ "ldap_host" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/Loggly.json b/app/_schemas/ai-gateway/policies/Loggly.json index c5742500b36..5ca7a2ae37e 100644 --- a/app/_schemas/ai-gateway/policies/Loggly.json +++ b/app/_schemas/ai-gateway/policies/Loggly.json @@ -34,7 +34,12 @@ "description": "A string representing a host name, such as example.com.", "default": "logs-01.loggly.com" }, - "log_level": { + "key": { + "type": "string", + "x-referenceable": true, + "x-encrypted": true + }, + "client_errors_severity": { "type": "string", "enum": [ "alert", @@ -66,11 +71,6 @@ "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 514 }, - "key": { - "type": "string", - "x-referenceable": true, - "x-encrypted": true - }, "tags": { "type": "array", "items": { @@ -80,7 +80,7 @@ "kong" ] }, - "successful_severity": { + "log_level": { "type": "string", "enum": [ "alert", @@ -94,7 +94,7 @@ ], "default": "info" }, - "client_errors_severity": { + "successful_severity": { "type": "string", "enum": [ "alert", @@ -127,7 +127,7 @@ "key" ] }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -135,9 +135,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -145,9 +145,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -155,7 +155,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/MeteringAndBilling.json b/app/_schemas/ai-gateway/policies/MeteringAndBilling.json index eaa5095cd76..85dbb846176 100644 --- a/app/_schemas/ai-gateway/policies/MeteringAndBilling.json +++ b/app/_schemas/ai-gateway/policies/MeteringAndBilling.json @@ -29,14 +29,28 @@ "config": { "type": "object", "properties": { - "keepalive": { + "ssl_verify": { + "type": "boolean", + "description": "Verify the TLS certificate presented by the ingest endpoint.", + "default": true + }, + "timeout": { "type": "number", - "description": "How long in milliseconds an idle connection to the ingest endpoint is kept open before being closed.", - "default": 60000 + "description": "Maximum time in milliseconds to wait for a response from the ingest endpoint.", + "default": 10000 }, "queue": { "type": "object", "properties": { + "concurrency_limit": { + "type": "integer", + "enum": [ + -1, + 1 + ], + "description": "The number of of queue delivery timers. -1 indicates unlimited.", + "default": 1 + }, "max_batch_size": { "type": "integer", "maximum": 1000000, @@ -80,27 +94,29 @@ "minimum": 0.001, "description": "Maximum time in seconds between retries, caps exponential backoff.", "default": 60 - }, - "concurrency_limit": { - "type": "integer", - "enum": [ - -1, - 1 - ], - "description": "The number of of queue delivery timers. -1 indicates unlimited.", - "default": 1 } } }, - "meter_api_requests": { + "meter_ai_token_usage": { "type": "boolean", - "description": "Emit a usage event for each API Gateway request.", + "description": "Emit events for LLM input and output tokens on AI Gateway requests.", "default": true }, - "ssl_verify": { - "type": "boolean", - "description": "Verify the TLS certificate presented by the ingest endpoint.", - "default": true + "ingest_endpoint": { + "type": "string", + "description": "The HTTP endpoint where usage events are sent.", + "x-referenceable": true + }, + "api_token": { + "type": "string", + "description": "Bearer token for authenticating with the ingest endpoint.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive": { + "type": "number", + "description": "How long in milliseconds an idle connection to the ingest endpoint is kept open before being closed.", + "default": 60000 }, "attributes": { "type": "array", @@ -153,26 +169,10 @@ }, "description": "The subject identifies who gets billed for each request. Choose where the policy should look for the customer identifier." }, - "meter_ai_token_usage": { + "meter_api_requests": { "type": "boolean", - "description": "Emit events for LLM input and output tokens on AI Gateway requests.", + "description": "Emit a usage event for each API Gateway request.", "default": true - }, - "ingest_endpoint": { - "type": "string", - "description": "The HTTP endpoint where usage events are sent.", - "x-referenceable": true - }, - "api_token": { - "type": "string", - "description": "Bearer token for authenticating with the ingest endpoint.", - "x-encrypted": true, - "x-referenceable": true - }, - "timeout": { - "type": "number", - "description": "Maximum time in milliseconds to wait for a response from the ingest endpoint.", - "default": 10000 } }, "required": [ @@ -180,7 +180,7 @@ "ingest_endpoint" ] }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -188,9 +188,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -198,9 +198,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -208,7 +208,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/Mocking.json b/app/_schemas/ai-gateway/policies/Mocking.json index 2d6f6c1882c..5137e437d56 100644 --- a/app/_schemas/ai-gateway/policies/Mocking.json +++ b/app/_schemas/ai-gateway/policies/Mocking.json @@ -22,54 +22,54 @@ "config": { "type": "object", "properties": { - "custom_base_path": { - "type": "string", - "description": "The base path to be used for path match evaluation. This value is ignored if `include_base_path` is set to `false`." - }, - "max_delay_time": { - "type": "number", - "description": "The maximum value in seconds of delay time. Set this value when `random_delay` is enabled and you want to adjust the default. The value must be greater than the `min_delay_time`.", - "default": 1 - }, - "min_delay_time": { - "type": "number", - "description": "The minimum value in seconds of delay time. Set this value when `random_delay` is enabled and you want to adjust the default. The value must be less than the `max_delay_time`.", - "default": 0.001 - }, - "included_status_codes": { - "type": "array", - "items": { - "type": "integer" - }, - "description": "A global list of the HTTP status codes that can only be selected and returned." + "random_status_code": { + "type": "boolean", + "description": "Determines whether to randomly select an HTTP status code from the responses of the corresponding API method. The default value is `false`, which means the minimum HTTP status code is always selected and returned.", + "default": false }, "include_base_path": { "type": "boolean", "description": "Indicates whether to include the base path when performing path match evaluation.", "default": false }, - "api_specification_filename": { - "type": "string", - "description": "The path and name of the specification file loaded into Kong Gateway's database. You cannot use this option for DB-less or hybrid mode." - }, "api_specification": { "type": "string", "description": "The contents of the specification file. You must use this option for hybrid or DB-less mode. You can include the full specification as part of the configuration. In Kong Manager, you can copy and paste the contents of the spec directly into the `Config.Api Specification` text field." }, + "custom_base_path": { + "type": "string", + "description": "The base path to be used for path match evaluation. This value is ignored if `include_base_path` is set to `false`." + }, + "api_specification_filename": { + "type": "string", + "description": "The path and name of the specification file loaded into Kong Gateway's database. You cannot use this option for DB-less or hybrid mode." + }, "random_delay": { "type": "boolean", "description": "Enables a random delay in the mocked response. Introduces delays to simulate real-time response times by APIs.", "default": false }, + "max_delay_time": { + "type": "number", + "description": "The maximum value in seconds of delay time. Set this value when `random_delay` is enabled and you want to adjust the default. The value must be greater than the `min_delay_time`.", + "default": 1 + }, + "min_delay_time": { + "type": "number", + "description": "The minimum value in seconds of delay time. Set this value when `random_delay` is enabled and you want to adjust the default. The value must be less than the `max_delay_time`.", + "default": 0.001 + }, "random_examples": { "type": "boolean", "description": "Randomly selects one example and returns it. This parameter requires the spec to have multiple examples configured.", "default": false }, - "random_status_code": { - "type": "boolean", - "description": "Determines whether to randomly select an HTTP status code from the responses of the corresponding API method. The default value is `false`, which means the minimum HTTP status code is always selected and returned.", - "default": false + "included_status_codes": { + "type": "array", + "items": { + "type": "integer" + }, + "description": "A global list of the HTTP status codes that can only be selected and returned." } } }, diff --git a/app/_schemas/ai-gateway/policies/MtlsAuth.json b/app/_schemas/ai-gateway/policies/MtlsAuth.json index 2586aa0c7cb..2b02bcc5f9e 100644 --- a/app/_schemas/ai-gateway/policies/MtlsAuth.json +++ b/app/_schemas/ai-gateway/policies/MtlsAuth.json @@ -1,5 +1,26 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "model": { "type": "object", "properties": { @@ -13,28 +34,75 @@ "config": { "type": "object", "properties": { - "skip_consumer_lookup": { + "anonymous": { + "type": "string", + "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." + }, + "allow_partial_chain": { "type": "boolean", - "description": "Skip consumer lookup once certificate is trusted against the configured CA list.", + "description": "Allow certificate verification with only an intermediate certificate. When this is enabled, you don't need to upload the full chain to Kong Certificates.", + "default": false + }, + "authenticated_group_by": { + "type": "string", + "enum": [ + "CN", + "DN" + ], + "description": "Certificate property to use as the authenticated group. Valid values are `CN` (Common Name) or `DN` (Distinguished Name). Once `skip_consumer_lookup` is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL policy (not covered here) and create allowed or denied groups of users.", + "default": "CN" + }, + "send_ca_dn": { + "type": "boolean", + "description": "Sends the distinguished names (DN) of the configured CA list in the TLS handshake message.", "default": false }, "default_consumer": { "type": "string", "description": "The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." }, - "http_proxy_port": { + "ssl_verify": { + "type": "boolean", + "description": "This option enables verification of the certificate presented by the server of the OCSP responder's URL and by the server of the CRL Distribution Point.", + "default": true + }, + "http_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, + "https_proxy_port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive." }, - "https_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." + "ca_certificates": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (`id`)." }, - "anonymous": { - "type": "string", - "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." + "cache_ttl": { + "type": "number", + "description": "Cache expiry time in seconds.", + "default": 60 + }, + "skip_consumer_lookup": { + "type": "boolean", + "description": "Skip consumer lookup once certificate is trusted against the configured CA list.", + "default": false + }, + "http_timeout": { + "type": "number", + "description": "HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.", + "default": 30000 + }, + "http_proxy_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive." }, "consumer_by": { "type": "array", @@ -51,32 +119,6 @@ "username" ] }, - "http_timeout": { - "type": "number", - "description": "HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.", - "default": 30000 - }, - "send_ca_dn": { - "type": "boolean", - "description": "Sends the distinguished names (DN) of the configured CA list in the TLS handshake message.", - "default": false - }, - "ssl_verify": { - "type": "boolean", - "description": "This option enables verification of the certificate presented by the server of the OCSP responder's URL and by the server of the CRL Distribution Point.", - "default": true - }, - "http_proxy_host": { - "type": "string", - "description": "A string representing a host name, such as example.com." - }, - "ca_certificates": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (`id`)." - }, "san_dirname_matcher": { "type": "array", "items": { @@ -95,63 +137,21 @@ "description": "Controls client certificate revocation check behavior. If set to `SKIP`, no revocation check is performed. If set to `IGNORE_CA_ERROR`, the policy respects the revocation status when either OCSP or CRL URL is set, and doesn't fail on network issues. If set to `STRICT`, the policy only treats the certificate as valid when it's able to verify the revocation status.", "default": "IGNORE_CA_ERROR" }, + "https_proxy_host": { + "type": "string", + "description": "A string representing a host name, such as example.com." + }, "cert_cache_ttl": { "type": "number", "description": "The length of time in seconds between refreshes of the revocation check status cache.", "default": 60000 - }, - "https_proxy_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive." - }, - "allow_partial_chain": { - "type": "boolean", - "description": "Allow certificate verification with only an intermediate certificate. When this is enabled, you don't need to upload the full chain to Kong Certificates.", - "default": false - }, - "authenticated_group_by": { - "type": "string", - "enum": [ - "CN", - "DN" - ], - "description": "Certificate property to use as the authenticated group. Valid values are `CN` (Common Name) or `DN` (Distinguished Name). Once `skip_consumer_lookup` is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL policy (not covered here) and create allowed or denied groups of users.", - "default": "CN" - }, - "cache_ttl": { - "type": "number", - "description": "Cache expiry time in seconds.", - "default": 60 } }, "required": [ "ca_certificates" ] }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -159,9 +159,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -169,7 +169,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/OasValidation.json b/app/_schemas/ai-gateway/policies/OasValidation.json index ccad9f613d2..d1e295ec301 100644 --- a/app/_schemas/ai-gateway/policies/OasValidation.json +++ b/app/_schemas/ai-gateway/policies/OasValidation.json @@ -1,75 +1,38 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "header_parameter_check": { - "type": "boolean", - "description": "If set to true, checks if HTTP header parameters in the request exist in the API specification.", - "default": false - }, "include_base_path": { "type": "boolean", "description": "Indicates whether to include the base path when performing path match evaluation.", "default": false }, - "verbose_response": { - "type": "boolean", - "description": "If set to true, returns a detailed error message for invalid requests & responses. This is useful while testing.", - "default": false - }, "notify_only_request_validation_failure": { "type": "boolean", "description": "If set to true, notifications via event hooks are enabled, but request based validation failures don't affect the request flow.", "default": false }, - "validate_response_body": { + "validate_request_query_params": { "type": "boolean", - "description": "If set to true, validates the response from the upstream services against the API specification. If validation fails, it results in an `HTTP 406 Not Acceptable` status code.", - "default": false - }, - "custom_base_path": { - "type": "string", - "description": "The base path to be used for path match evaluation. This value is ignored if `include_base_path` is set to `false`." + "description": "If set to true, validates query parameters against the API specification.", + "default": true }, "notify_only_response_body_validation_failure": { "type": "boolean", "description": "If set to true, notifications via event hooks are enabled, but response validation failures don't affect the response flow.", "default": false }, - "allowed_header_parameters": { - "type": "string", - "description": "List of header parameters in the request that will be ignored when performing HTTP header validation. These are additional headers added to an API request beyond those defined in the API specification. For example, you might include the HTTP header `User-Agent`, which lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.", - "default": "Host,Content-Type,User-Agent,Accept,Content-Length" + "query_parameter_check": { + "type": "boolean", + "description": "If set to true, checks if query parameters in the request exist in the API specification.", + "default": false }, "api_spec_encoded": { "type": "boolean", "description": "Indicates whether the api_spec is URI-Encoded.", "default": true }, - "api_spec": { - "type": "string", - "description": "The API specification defined using either Swagger or the OpenAPI. This can be either a JSON or YAML based file. If using a YAML file, the spec needs to be URI-Encoded to preserve the YAML format." - }, "validate_request_body": { "type": "boolean", "description": "If set to true, validates the request body content against the API specification.", @@ -80,32 +43,69 @@ "description": "If set to true, validates HTTP header parameters against the API specification.", "default": true }, - "validate_request_query_params": { - "type": "boolean", - "description": "If set to true, validates query parameters against the API specification.", - "default": true - }, - "query_parameter_check": { + "header_parameter_check": { "type": "boolean", - "description": "If set to true, checks if query parameters in the request exist in the API specification.", + "description": "If set to true, checks if HTTP header parameters in the request exist in the API specification.", "default": false }, + "allowed_header_parameters": { + "type": "string", + "description": "List of header parameters in the request that will be ignored when performing HTTP header validation. These are additional headers added to an API request beyond those defined in the API specification. For example, you might include the HTTP header `User-Agent`, which lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.", + "default": "Host,Content-Type,User-Agent,Accept,Content-Length" + }, "collect_all_errors": { "type": "boolean", "description": "If set to true, collects all validation errors instead of stopping at the first error. Note: Enabling this option with OpenAPI 3.0 will affect performance.", "default": false }, + "verbose_response": { + "type": "boolean", + "description": "If set to true, returns a detailed error message for invalid requests & responses. This is useful while testing.", + "default": false + }, "validate_request_uri_params": { "type": "boolean", "description": "If set to true, validates URI parameters in the request against the API specification.", "default": true + }, + "custom_base_path": { + "type": "string", + "description": "The base path to be used for path match evaluation. This value is ignored if `include_base_path` is set to `false`." + }, + "api_spec": { + "type": "string", + "description": "The API specification defined using either Swagger or the OpenAPI. This can be either a JSON or YAML based file. If using a YAML file, the spec needs to be URI-Encoded to preserve the YAML format." + }, + "validate_response_body": { + "type": "boolean", + "description": "If set to true, validates the response from the upstream services against the API specification. If validation fails, it results in an `HTTP 406 Not Acceptable` status code.", + "default": false } }, "required": [ "api_spec" ] }, - "service": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "consumer": { "type": "object", "properties": { "id": { @@ -113,9 +113,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -123,9 +123,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -133,7 +133,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/Oauth2.json b/app/_schemas/ai-gateway/policies/Oauth2.json index 69968c31545..212603fad16 100644 --- a/app/_schemas/ai-gateway/policies/Oauth2.json +++ b/app/_schemas/ai-gateway/policies/Oauth2.json @@ -1,5 +1,28 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, "model": { "type": "object", "properties": { @@ -13,34 +36,56 @@ "config": { "type": "object", "properties": { - "auth_header_name": { - "type": "string", - "description": "The name of the header that is supposed to carry the access token.", - "default": "authorization" + "token_expiration": { + "type": "number", + "description": "An optional integer value telling the policy how many seconds a token should last, after which the client will need to refresh the token. Set to `0` to disable the expiration.", + "default": 7200 }, - "reuse_refresh_token": { + "enable_authorization_code": { "type": "boolean", - "description": "An optional boolean value that indicates whether an OAuth refresh token is reused when refreshing an access token.", + "description": "An optional boolean value to enable the three-legged Authorization Code flow (RFC 6742 Section 4.1).", "default": false }, - "mandatory_scope": { + "hide_credentials": { "type": "boolean", - "description": "An optional boolean value telling the policy to require at least one `scope` to be authorized by the end user.", - "default": false + "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service.", + "default": true }, - "enable_implicit_grant": { + "accept_http_if_already_terminated": { "type": "boolean", - "description": "An optional boolean value to enable the Implicit Grant flow which allows to provision a token as a result of the authorization process (RFC 6742 Section 4.2).", + "description": "Accepts HTTPs requests that have already been terminated by a proxy or load balancer.", "default": false }, + "pkce": { + "type": "string", + "enum": [ + "lax", + "none", + "strict" + ], + "description": "Specifies a mode of how the Proof Key for Code Exchange (PKCE) should be handled by the policy.", + "default": "lax" + }, + "realm": { + "type": "string", + "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." + }, + "scopes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Describes an array of scope names that will be available to the end user. If `mandatory_scope` is set to `true`, then `scopes` are required." + }, "enable_client_credentials": { "type": "boolean", "description": "An optional boolean value to enable the Client Credentials Grant flow (RFC 6742 Section 4.4).", "default": false }, - "anonymous": { - "type": "string", - "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails." + "global_credentials": { + "type": "boolean", + "description": "An optional boolean value that allows using the same OAuth credentials generated by the policy with any other service whose OAuth 2.0 policy configuration also has `config.global_credentials=true`.", + "default": false }, "refresh_token_ttl": { "type": "number", @@ -49,28 +94,14 @@ "description": "Time-to-live value for data", "default": 1209600 }, - "persistent_refresh_token": { + "reuse_refresh_token": { "type": "boolean", + "description": "An optional boolean value that indicates whether an OAuth refresh token is reused when refreshing an access token.", "default": false }, - "pkce": { - "type": "string", - "enum": [ - "lax", - "none", - "strict" - ], - "description": "Specifies a mode of how the Proof Key for Code Exchange (PKCE) should be handled by the policy.", - "default": "lax" - }, - "hide_credentials": { - "type": "boolean", - "description": "An optional boolean value telling the policy to show or hide the credential from the upstream service.", - "default": true - }, - "global_credentials": { + "mandatory_scope": { "type": "boolean", - "description": "An optional boolean value that allows using the same OAuth credentials generated by the policy with any other service whose OAuth 2.0 policy configuration also has `config.global_credentials=true`.", + "description": "An optional boolean value telling the policy to require at least one `scope` to be authorized by the end user.", "default": false }, "provision_key": { @@ -78,62 +109,31 @@ "description": "The unique key the policy has generated when it has been added to the Service.", "x-encrypted": true }, + "enable_implicit_grant": { + "type": "boolean", + "description": "An optional boolean value to enable the Implicit Grant flow which allows to provision a token as a result of the authorization process (RFC 6742 Section 4.2).", + "default": false + }, "enable_password_grant": { "type": "boolean", "description": "An optional boolean value to enable the Resource Owner Password Credentials Grant flow (RFC 6742 Section 4.3).", "default": false }, - "realm": { + "anonymous": { "type": "string", - "description": "When authentication fails the policy sends `WWW-Authenticate` header with `realm` attribute value." - }, - "scopes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Describes an array of scope names that will be available to the end user. If `mandatory_scope` is set to `true`, then `scopes` are required." - }, - "token_expiration": { - "type": "number", - "description": "An optional integer value telling the policy how many seconds a token should last, after which the client will need to refresh the token. Set to `0` to disable the expiration.", - "default": 7200 + "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails." }, - "enable_authorization_code": { - "type": "boolean", - "description": "An optional boolean value to enable the three-legged Authorization Code flow (RFC 6742 Section 4.1).", - "default": false + "auth_header_name": { + "type": "string", + "description": "The name of the header that is supposed to carry the access token.", + "default": "authorization" }, - "accept_http_if_already_terminated": { + "persistent_refresh_token": { "type": "boolean", - "description": "Accepts HTTPs requests that have already been terminated by a proxy or load balancer.", "default": false } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/Oauth2Introspection.json b/app/_schemas/ai-gateway/policies/Oauth2Introspection.json index 603b2d6e3e5..33c2b083625 100644 --- a/app/_schemas/ai-gateway/policies/Oauth2Introspection.json +++ b/app/_schemas/ai-gateway/policies/Oauth2Introspection.json @@ -36,21 +36,24 @@ "type": "string", "description": "The `token_type_hint` value to associate to introspection requests." }, - "introspect_request": { - "type": "boolean", - "description": "A boolean indicating whether to forward information about the current downstream request to the introspect endpoint. If true, headers `X-Request-Path` and `X-Request-Http-Method` will be inserted into the introspect request.", - "default": false - }, - "hide_credentials": { - "type": "boolean", - "description": "An optional boolean value telling the policy to hide the credential to the upstream API server. It will be removed by Kong before proxying the request.", - "default": true + "timeout": { + "type": "integer", + "description": "An optional timeout in milliseconds when sending data to the upstream server.", + "default": 10000 }, "anonymous": { "type": "string", "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure `4xx`. Note that this value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`.", "default": "" }, + "custom_introspection_headers": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "A list of custom headers to be added in the introspection request.", + "default": {} + }, "custom_claims_forward": { "type": "array", "items": { @@ -59,22 +62,32 @@ "description": "A list of custom claims to be forwarded from the introspection response to the upstream request. Claims are forwarded in headers with prefix `X-Credential-{claim-name}`.", "default": [] }, + "ttl": { + "type": "number", + "description": "The TTL in seconds for the introspection response. Set to 0 to disable the expiration.", + "default": 30 + }, "authorization_value": { "type": "string", "description": "The value to set as the `Authorization` header when querying the introspection endpoint. This depends on the OAuth 2.0 server, but usually is the `client_id` and `client_secret` as a Base64-encoded Basic Auth string (`Basic MG9hNWl...`).", "x-referenceable": true, "x-encrypted": true }, - "timeout": { - "type": "integer", - "description": "An optional timeout in milliseconds when sending data to the upstream server.", - "default": 10000 - }, "keepalive": { "type": "integer", "description": "An optional value in milliseconds that defines how long an idle connection lives before being closed.", "default": 60000 }, + "introspect_request": { + "type": "boolean", + "description": "A boolean indicating whether to forward information about the current downstream request to the introspect endpoint. If true, headers `X-Request-Path` and `X-Request-Http-Method` will be inserted into the introspect request.", + "default": false + }, + "hide_credentials": { + "type": "boolean", + "description": "An optional boolean value telling the policy to hide the credential to the upstream API server. It will be removed by Kong before proxying the request.", + "default": true + }, "run_on_preflight": { "type": "boolean", "description": "A boolean value that indicates whether the policy should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests will always be allowed.", @@ -89,22 +102,9 @@ "description": "A string indicating whether to associate OAuth2 `username` or `client_id` with the consumer's username. OAuth2 `username` is mapped to a consumer's `username` field, while an OAuth2 `client_id` maps to a consumer's `custom_id`.", "default": "username" }, - "custom_introspection_headers": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "A list of custom headers to be added in the introspection request.", - "default": {} - }, "introspection_url": { "type": "string", "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "ttl": { - "type": "number", - "description": "The TTL in seconds for the introspection response. Set to 0 to disable the expiration.", - "default": 30 } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/Opa.json b/app/_schemas/ai-gateway/policies/Opa.json index dc28770222b..25e726496d5 100644 --- a/app/_schemas/ai-gateway/policies/Opa.json +++ b/app/_schemas/ai-gateway/policies/Opa.json @@ -26,23 +26,19 @@ "type": "string", "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." }, - "include_route_in_opa_input": { - "type": "boolean", - "description": "If set to true, the Kong Gateway Route object in use for the current request is included as input to OPA.", - "default": false - }, - "include_consumer_in_opa_input": { + "include_service_in_opa_input": { "type": "boolean", - "description": "If set to true, the Kong Gateway Consumer object in use for the current request (if any) is included as input to OPA.", + "description": "If set to true, the Kong Gateway Service object in use for the current request is included as input to OPA.", "default": false }, - "include_body_in_opa_input": { + "include_route_in_opa_input": { "type": "boolean", + "description": "If set to true, the Kong Gateway Route object in use for the current request is included as input to OPA.", "default": false }, - "include_uri_captures_in_opa_input": { + "include_parsed_json_body_in_opa_input": { "type": "boolean", - "description": "If set to true, the regex capture groups captured on the Kong Gateway Route's path field in the current request (if any) are included as input to OPA.", + "description": "If set to true and the `Content-Type` header of the current request is `application/json`, the request body will be JSON decoded and the decoded struct is included as input to OPA.", "default": false }, "opa_protocol": { @@ -54,21 +50,6 @@ "description": "The protocol to use when talking to Open Policy Agent (OPA) server. Allowed protocols are `http` and `https`.", "default": "http" }, - "include_service_in_opa_input": { - "type": "boolean", - "description": "If set to true, the Kong Gateway Service object in use for the current request is included as input to OPA.", - "default": false - }, - "include_parsed_json_body_in_opa_input": { - "type": "boolean", - "description": "If set to true and the `Content-Type` header of the current request is `application/json`, the request body will be JSON decoded and the decoded struct is included as input to OPA.", - "default": false - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, the OPA certificate will be verified according to the CA certificates specified in lua_ssl_trusted_certificate.", - "default": true - }, "opa_host": { "type": "string", "description": "A string representing a host name, such as example.com.", @@ -80,6 +61,25 @@ "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 8181 + }, + "include_consumer_in_opa_input": { + "type": "boolean", + "description": "If set to true, the Kong Gateway Consumer object in use for the current request (if any) is included as input to OPA.", + "default": false + }, + "include_body_in_opa_input": { + "type": "boolean", + "default": false + }, + "include_uri_captures_in_opa_input": { + "type": "boolean", + "description": "If set to true, the regex capture groups captured on the Kong Gateway Route's path field in the current request (if any) are included as input to OPA.", + "default": false + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, the OPA certificate will be verified according to the CA certificates specified in lua_ssl_trusted_certificate.", + "default": true } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/OpenidConnect.json b/app/_schemas/ai-gateway/policies/OpenidConnect.json index dad2cf3a5d1..13ac73cc606 100644 --- a/app/_schemas/ai-gateway/policies/OpenidConnect.json +++ b/app/_schemas/ai-gateway/policies/OpenidConnect.json @@ -1,26 +1,5 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "ws", - "wss" - ] - }, - "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "model": { "type": "object", "properties": { @@ -34,33 +13,21 @@ "config": { "type": "object", "properties": { - "upstream_id_token_jwk_header": { - "type": "string", - "description": "The upstream id token JWK header." - }, - "tls_client_auth_ssl_verify": { - "type": "boolean", - "description": "Verify identity provider server certificate during mTLS client authentication.", - "default": true - }, - "bearer_token_header_name": { - "type": "string", - "description": "The name of the HTTP header from which the bearer token is retrieved. The default value is `authorization:bearer`, which reads the token from the `Authorization: Bearer ` header. Accepts plain header names such as `x-my-token` as well as Kong's special `authorization:bearer` notation. The `access-token` and `x-access-token` headers are also checked as a fallback for backward compatibility regardless of this setting.", - "default": "authorization:bearer" - }, - "upstream_user_info_jwt_header": { - "type": "string", - "description": "The upstream user info JWT header (in case the user info returns a JWT response)." - }, - "by_username_ignore_case": { - "type": "boolean", - "description": "If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.", - "default": false - }, - "resolve_distributed_claims": { - "type": "boolean", - "description": "Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the policy explicitly resolves these distributed claims.", - "default": false + "client_auth": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" + ] + }, + "description": "The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication)." }, "response_type": { "type": "array", @@ -72,35 +39,45 @@ "code" ] }, - "bearer_token_param_type": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "body", - "cookie", - "header", - "query" - ] - }, - "description": "Where to look for the bearer token: - `header`: search the `Authorization`, `access-token`, and `x-access-token` HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.", - "default": [ - "body", - "header", - "query" - ] + "revocation_endpoint": { + "type": "string", + "description": "The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint." }, - "verify_parameters": { + "logout_uri_suffix": { + "type": "string", + "description": "The request URI suffix that activates the logout." + }, + "display_errors": { "type": "boolean", - "description": "Verify policy configuration against discovery.", + "description": "Display errors on failure responses.", "default": false }, - "discovery_headers_names": { + "issuers_allowed": { "type": "array", "items": { - "type": "string" + "type": "string", + "x-referenceable": true }, - "description": "Extra header names passed to the discovery endpoint." + "description": "The issuers allowed to be present in the tokens (`iss` claim)." + }, + "session_absolute_timeout": { + "type": "number", + "description": "Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", + "default": 86400 + }, + "login_action": { + "type": "string", + "enum": [ + "redirect", + "response", + "upstream" + ], + "description": "What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.", + "default": "upstream" + }, + "cache_ttl_resurrect": { + "type": "number", + "description": "The resurrection ttl in seconds." }, "client_id": { "type": "array", @@ -111,71 +88,36 @@ "description": "The client id(s) that the policy uses when it calls authenticated endpoints on the identity provider.", "x-encrypted": true }, - "client_alg": { + "token_post_args_values": { "type": "array", "items": { - "type": "string", - "enum": [ - "ES256", - "ES384", - "ES512", - "EdDSA", - "HS256", - "HS384", - "HS512", - "PS256", - "PS384", - "PS512", - "RS256", - "RS384", - "RS512" - ] + "type": "string" }, - "description": "The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication." - }, - "session_cookie_same_site": { - "type": "string", - "enum": [ - "Default", - "Lax", - "None", - "Strict" - ], - "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", - "default": "Lax" + "description": "Extra post argument values passed to the token endpoint." }, - "logout_redirect_uri": { + "introspection_post_args_client": { "type": "array", "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "x-referenceable": true + "type": "string" }, - "description": "Where to redirect the client after the logout." + "description": "Extra post arguments passed from the client to the introspection endpoint." }, - "upstream_headers_claims": { + "introspection_post_args_client_headers": { "type": "array", "items": { "type": "string" }, - "description": "The upstream header claims. Only top level claims are supported." + "description": "Extra post arguments passed from the client headers to the introspection endpoint." }, - "require_signed_request_object": { + "session_cookie_secure": { "type": "boolean", - "description": "Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled)." + "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." }, - "token_exchange_endpoint": { + "downstream_introspection_header": { "type": "string", - "description": "Endpoint used to perform the legacy token exchange." - }, - "downstream_headers_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The downstream header names for the claim values." + "description": "The downstream introspection header." }, - "login_methods": { + "disable_session": { "type": "array", "items": { "type": "string", @@ -191,15 +133,11 @@ "userinfo" ] }, - "description": "Enable login functionality with specified grants.", - "default": [ - "authorization_code" - ] + "description": "Disable issuing the session cookie with the specified grants." }, - "session_hash_storage_key": { - "type": "boolean", - "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.", - "default": false + "http_proxy": { + "type": "string", + "description": "The HTTP proxy." }, "session_memcached_port": { "type": "integer", @@ -208,70 +146,247 @@ "description": "The memcached port.", "default": 11211 }, - "logout_query_arg": { + "session_cookie_domain": { "type": "string", - "description": "The request query argument that activates the logout." + "description": "The session cookie Domain flag." }, - "session_cookie_http_only": { + "userinfo_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header names passed to the user info endpoint." + }, + "session_memcached_socket": { + "type": "string", + "description": "The memcached unix socket path." + }, + "verify_claims": { "type": "boolean", - "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", + "description": "Verify tokens for standard claims.", "default": true }, - "extra_jwks_uris": { + "unauthorized_destroy_session": { + "type": "boolean", + "description": "Destroy any active session for the unauthorized requests.", + "default": true + }, + "roles_claim": { "type": "array", "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "x-referenceable": true + "type": "string" }, - "description": "JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery)." + "description": "The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "roles" + ] }, - "audience_required": { + "token_headers_prefix": { + "type": "string", + "description": "Add a prefix to the token endpoint response headers before forwarding them to the downstream client." + }, + "userinfo_headers_client": { "type": "array", "items": { "type": "string" }, - "description": "The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." + "description": "Extra headers passed from the client to the user info endpoint." }, - "revocation_endpoint": { - "type": "string", - "description": "The revocation endpoint. If set it overrides the value in `revocation_endpoint` returned by the discovery endpoint." + "password_param_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ] + }, + "description": "Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] }, - "search_user_info": { + "consumer_optional": { "type": "boolean", - "description": "Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.", + "description": "Do not terminate the request if consumer mapping fails.", "default": false }, + "by_username_ignore_case": { + "type": "boolean", + "description": "If `consumer_by` is set to `username`, specify whether `username` can match consumers case-insensitively.", + "default": false + }, + "resolve_distributed_claims": { + "type": "boolean", + "description": "Distributed claims are represented by the `_claim_names` and `_claim_sources` members of the JSON object containing the claims. If this parameter is set to `true`, the policy explicitly resolves these distributed claims.", + "default": false + }, + "rediscovery_lifetime": { + "type": "number", + "description": "Specifies how long (in seconds) the policy waits between discovery attempts. Discovery is still triggered on an as-needed basis.", + "default": 30 + }, + "token_endpoint": { + "type": "string", + "description": "The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint." + }, + "userinfo_query_args_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra query argument names passed to the user info endpoint." + }, + "upstream_headers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "header": { + "type": "string", + "description": "The name of the header." + }, + "path": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "The path of the header value." + } + }, + "required": [ + "header", + "path" + ] + }, + "description": "The upstream claim to header mappings." + }, + "credential_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting policy), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "sub" + ] + }, + "introspection_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header names passed to the introspection endpoint." + }, + "logout_post_arg": { + "type": "string", + "description": "The request body argument that activates the logout." + }, + "verify_parameters": { + "type": "boolean", + "description": "Verify policy configuration against discovery.", + "default": false + }, + "audience": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The audience passed to the authorization endpoint." + }, + "introspection_headers_values": { + "type": "array", + "items": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra header values passed to the introspection endpoint.", + "x-encrypted": true + }, + "client_credentials_param_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ] + }, + "description": "Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] + }, + "proof_of_possession_auth_methods_validation": { + "type": "boolean", + "description": "If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.", + "default": true + }, + "upstream_access_token_header": { + "type": "string", + "description": "The upstream access token header.", + "default": "authorization:bearer" + }, + "upstream_session_id_header": { + "type": "string", + "description": "The upstream session id header." + }, "token_exchange": { "type": "object", "properties": { + "cache": { + "type": "object", + "properties": { + "ttl": { + "type": "integer", + "description": "Cache ttl in seconds used when caching exchanged tokens, use it to override `conf.cache_ttl`. Token expiry will be used if shorter than this value." + }, + "enabled": { + "type": "boolean", + "description": "Whether to enable caching.", + "default": true + } + }, + "description": "Cache support for token exchange" + }, "subject_token_issuers": { "type": "array", "items": { "type": "object", "properties": { + "issuer": { + "type": "string", + "description": "Tokens of whose iss claim matches this value will be exchanged." + }, "conditions": { "type": "object", "properties": { - "has_audience": { + "missing_audience": { "type": "array", "items": { "type": "string" } }, - "missing_audience": { + "has_scopes": { "type": "array", "items": { "type": "string" } }, - "has_scopes": { + "missing_scopes": { "type": "array", "items": { "type": "string" } }, - "missing_scopes": { + "has_audience": { "type": "array", "items": { "type": "string" @@ -279,10 +394,6 @@ } }, "description": "A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined." - }, - "issuer": { - "type": "string", - "description": "Tokens of whose iss claim matches this value will be exchanged." } }, "required": [ @@ -321,21 +432,6 @@ } }, "description": "Parameters used in the token exchange request." - }, - "cache": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "Whether to enable caching.", - "default": true - }, - "ttl": { - "type": "integer", - "description": "Cache ttl in seconds used when caching exchanged tokens, use it to override `conf.cache_ttl`. Token expiry will be used if shorter than this value." - } - }, - "description": "Cache support for token exchange" } }, "required": [ @@ -343,65 +439,49 @@ ], "description": "Details on how to accept tokens from other identity providers." }, - "authorization_endpoint": { - "type": "string", - "description": "The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint." - }, - "downstream_access_token_header": { + "downstream_user_info_jwt_header": { "type": "string", - "description": "The downstream access token header." + "description": "The downstream user info JWT header (in case the user info returns a JWT response)." }, - "downstream_access_token_jwk_header": { + "downstream_user_info_header": { "type": "string", - "description": "The downstream access token JWK header." + "description": "The downstream user info header." }, - "dpop_use_nonce": { + "enable_hs_signatures": { "type": "boolean", - "description": "Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.", + "description": "Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).", "default": false }, - "discovery_headers_values": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra header values passed to the discovery endpoint." - }, - "userinfo_query_args_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra query argument names passed to the user info endpoint." - }, - "cache_tokens_salt": { + "http_proxy_authorization": { "type": "string", - "description": "Salt used for generating the cache key that is used for caching the token endpoint requests." - }, - "timeout": { - "type": "number", - "description": "Network IO timeout in milliseconds.", - "default": 10000 - }, - "require_pushed_authorization_requests": { - "type": "boolean", - "description": "Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`)." + "description": "The HTTP proxy authorization.", + "x-referenceable": true }, - "userinfo_headers_client": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra headers passed from the client to the user info endpoint." + "proof_of_possession_mtls": { + "type": "string", + "enum": [ + "off", + "optional", + "strict" + ], + "description": "Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.", + "default": "off" }, - "audience": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The audience passed to the authorization endpoint." + "response_mode": { + "type": "string", + "enum": [ + "form_post", + "form_post.jwt", + "fragment", + "fragment.jwt", + "jwt", + "query", + "query.jwt" + ], + "description": "Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the policy itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.", + "default": "query" }, - "pushed_authorization_request_endpoint_auth_method": { + "revocation_endpoint_auth_method": { "type": "string", "enum": [ "client_secret_basic", @@ -412,195 +492,152 @@ "self_signed_tls_client_auth", "tls_client_auth" ], - "description": "The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" + "description": "The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" }, - "session_request_headers": { + "authenticated_groups_claim": { "type": "array", "items": { - "type": "string", - "enum": [ - "absolute-timeout", - "audience", - "id", - "idling-timeout", - "rolling-timeout", - "subject", - "timeout" - ] + "type": "string" }, - "description": "Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout request headers." + "description": "The claim that contains authenticated groups. This setting can be used together with ACL policy, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload." }, - "id_token_param_name": { + "upstream_user_info_header": { "type": "string", - "description": "The name of the parameter used to pass the id token." + "description": "The upstream user info header." }, - "introspection_headers_names": { + "introspection_post_args_values": { "type": "array", "items": { "type": "string" }, - "description": "Extra header names passed to the introspection endpoint." - }, - "http_proxy": { - "type": "string", - "description": "The HTTP proxy." + "description": "Extra post argument values passed to the introspection endpoint." }, - "proof_of_possession_dpop": { - "type": "string", - "enum": [ - "off", - "optional", - "strict" - ], - "description": "Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.", - "default": "off" + "dpop_proof_lifetime": { + "type": "number", + "description": "Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.", + "default": 300 }, - "session_audience": { - "type": "string", - "description": "The session audience, which is the intended target application. For example `\"my-application\"`.", - "default": "default" + "max_age": { + "type": "number", + "description": "The maximum age (in seconds) compared to the `auth_time` claim." }, - "token_endpoint_auth_method": { + "end_session_endpoint": { "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ], - "description": "The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" + "description": "The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint." }, - "introspection_accept": { + "bearer_token_header_name": { "type": "string", - "enum": [ - "application/json", - "application/jwt", - "application/token-introspection+jwt" - ], - "description": "The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).", - "default": "application/json" - }, - "auth_methods": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "authorization_code", - "bearer", - "client_credentials", - "introspection", - "kong_oauth2", - "password", - "refresh_token", - "session", - "userinfo" - ] - }, - "description": "Types of credentials/grants to enable.", - "default": [ - "authorization_code", - "bearer", - "client_credentials", - "introspection", - "kong_oauth2", - "password", - "refresh_token", - "session", - "userinfo" - ] + "description": "The name of the HTTP header from which the bearer token is retrieved. The default value is `authorization:bearer`, which reads the token from the `Authorization: Bearer ` header. Accepts plain header names such as `x-my-token` as well as Kong's special `authorization:bearer` notation. The `access-token` and `x-access-token` headers are also checked as a fallback for backward compatibility regardless of this setting.", + "default": "authorization:bearer" }, - "introspection_endpoint": { + "upstream_id_token_jwk_header": { "type": "string", - "description": "The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.", - "x-referenceable": true + "description": "The upstream id token JWK header." }, - "refresh_token_param_type": { + "downstream_headers": { "type": "array", "items": { - "type": "string", - "enum": [ - "body", + "type": "object", + "properties": { + "header": { + "type": "string", + "description": "The name of the header." + }, + "path": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "The path of the header value." + } + }, + "required": [ "header", - "query" + "path" ] }, - "description": "Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", - "default": [ - "body", - "header", - "query" - ] - }, - "authorization_query_args_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra query argument names passed to the authorization endpoint." + "description": "The downstream claim to header mappings." }, - "token_headers_names": { + "downstream_headers_claims": { "type": "array", "items": { "type": "string" }, - "description": "Extra header names passed to the token endpoint." + "description": "The downstream header claims. Only top level claims are supported." }, - "login_redirect_mode": { + "logout_query_arg": { "type": "string", - "enum": [ - "fragment", - "query" - ], - "description": "Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).", - "default": "fragment" - }, - "consumer_optional": { - "type": "boolean", - "description": "Do not terminate the request if consumer mapping fails.", - "default": false + "description": "The request query argument that activates the logout." }, - "mtls_token_endpoint": { + "https_proxy_authorization": { "type": "string", - "description": "Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." + "description": "The HTTPS proxy authorization.", + "x-referenceable": true }, - "jwks_endpoint": { + "session_bind": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "ip", + "scheme", + "user-agent" + ] + }, + "description": "Bind the session to data acquired from the HTTP request or connection." + }, + "pushed_authorization_request_endpoint": { "type": "string", - "description": "Overrides the `jwks_uri` returned by discovery. Use when the IdP exposes a non-standard JWKS endpoint." + "description": "The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint." }, - "domains": { + "introspection_post_args_names": { "type": "array", "items": { "type": "string" }, - "description": "The allowed values for the `hd` claim." + "description": "Extra post argument names passed to the introspection endpoint." }, - "introspect_jwt_tokens": { - "type": "boolean", - "description": "Specifies whether to introspect the JWT access tokens (can be used to check for revocations).", - "default": false + "mtls_introspection_endpoint": { + "type": "string", + "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." }, "client_jwk": { "type": "array", "items": { "type": "object", "properties": { + "r": { + "type": "string", + "x-referenceable": true, + "x-encrypted": true + }, + "issuer": { + "type": "string" + }, + "kty": { + "type": "string" + }, + "x5u": { + "type": "string" + }, "x5t#S256": { "type": "string" }, - "qi": { + "x": { + "type": "string" + }, + "p": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "t": { + "dp": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "x5u": { + "kid": { "type": "string" }, "x5c": { @@ -609,280 +646,178 @@ "type": "string" } }, - "k": { + "x5t": { + "type": "string" + }, + "t": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "e": { + "use": { "type": "string" }, - "d": { - "type": "string", - "x-referenceable": true, - "x-encrypted": true + "key_ops": { + "type": "array", + "items": { + "type": "string" + } }, - "p": { + "alg": { + "type": "string" + }, + "crv": { + "type": "string" + }, + "e": { + "type": "string" + }, + "q": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "dp": { + "oth": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "oth": { + "k": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "issuer": { - "type": "string" - }, - "x": { + "y": { "type": "string" }, - "y": { + "n": { "type": "string" }, - "r": { + "d": { "type": "string", - "x-encrypted": true, - "x-referenceable": true - }, - "use": { - "type": "string" - }, - "alg": { - "type": "string" - }, - "kid": { - "type": "string" - }, - "x5t": { - "type": "string" - }, - "crv": { - "type": "string" - }, - "n": { - "type": "string" - }, - "q": { - "type": "string", - "x-referenceable": true, - "x-encrypted": true + "x-referenceable": true, + "x-encrypted": true }, "dq": { "type": "string", "x-referenceable": true, "x-encrypted": true }, - "kty": { - "type": "string" - }, - "key_ops": { - "type": "array", - "items": { - "type": "string" - } + "qi": { + "type": "string", + "x-encrypted": true, + "x-referenceable": true } } }, "description": "The JWK used for the private_key_jwt authentication." }, - "scopes_claim": { + "forbidden_destroy_session": { + "type": "boolean", + "description": "Destroy any active session for the forbidden requests.", + "default": true + }, + "audience_required": { "type": "array", "items": { "type": "string" }, - "description": "The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "scope" - ] - }, - "login_action": { - "type": "string", - "enum": [ - "redirect", - "response", - "upstream" - ], - "description": "What to do after successful login: - `upstream`: proxy request to upstream service - `response`: terminate request with a response - `redirect`: redirect to a different location.", - "default": "upstream" - }, - "upstream_id_token_header": { - "type": "string", - "description": "The upstream id token header." - }, - "upstream_introspection_jwt_header": { - "type": "string", - "description": "The upstream introspection JWT header." - }, - "logout_uri_suffix": { - "type": "string", - "description": "The request URI suffix that activates the logout." - }, - "require_proof_key_for_code_exchange": { - "type": "boolean", - "description": "Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled)." + "description": "The audiences (`audience_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." }, - "cache_ttl": { + "authorization_rolling_timeout": { "type": "number", - "description": "The default cache ttl in seconds that is used in case the cached object does not specify the expiry.", - "default": 3600 + "description": "Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", + "default": 600 }, - "downstream_headers": { + "introspection_headers_client": { "type": "array", "items": { - "type": "object", - "properties": { - "path": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "The path of the header value." - }, - "header": { - "type": "string", - "description": "The name of the header." - } - }, - "required": [ - "header", - "path" - ] + "type": "string" }, - "description": "The downstream claim to header mappings." + "description": "Extra headers passed from the client to the introspection endpoint." }, - "logout_revoke_access_token": { + "session_hash_subject": { "type": "boolean", - "description": "Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.", - "default": true + "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.", + "default": false }, - "downstream_introspection_jwt_header": { + "upstream_introspection_jwt_header": { "type": "string", - "description": "The downstream introspection JWT header." + "description": "The upstream introspection JWT header." }, - "proof_of_possession_auth_methods_validation": { + "introspect_jwt_tokens": { "type": "boolean", - "description": "If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.", - "default": true - }, - "tls_client_auth_cert_id": { - "type": "string", - "description": "ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server." + "description": "Specifies whether to introspect the JWT access tokens (can be used to check for revocations).", + "default": false }, - "mtls_introspection_endpoint": { - "type": "string", - "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." + "session_idling_timeout": { + "type": "number", + "description": "Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.", + "default": 900 }, - "session_secret": { + "proof_of_possession_dpop": { "type": "string", - "description": "The session secret.", - "x-referenceable": true, - "x-encrypted": true + "enum": [ + "off", + "optional", + "strict" + ], + "description": "Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof.", + "default": "off" }, - "session_response_headers": { + "logout_redirect_uri": { "type": "array", "items": { "type": "string", - "enum": [ - "absolute-timeout", - "audience", - "id", - "idling-timeout", - "rolling-timeout", - "subject", - "timeout" - ] + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "x-referenceable": true }, - "description": "Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout response headers." + "description": "Where to redirect the client after the logout." }, - "logout_post_arg": { + "userinfo_endpoint": { "type": "string", - "description": "The request body argument that activates the logout." + "description": "The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint." }, - "consumer_by": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "custom_id", - "id", - "username" - ] - }, - "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.", - "default": [ - "custom_id", - "username" - ] + "cache_ttl_min": { + "type": "number", + "description": "The minimum cache ttl in seconds (enforced)." }, - "cache_user_info": { + "cache_ttl_neg": { + "type": "number", + "description": "The negative cache ttl in seconds." + }, + "session_remember": { "type": "boolean", - "description": "Cache the user info requests.", - "default": true + "description": "Enables or disables persistent sessions.", + "default": false }, - "response_mode": { + "upstream_introspection_header": { "type": "string", - "enum": [ - "form_post", - "form_post.jwt", - "fragment", - "fragment.jwt", - "jwt", - "query", - "query.jwt" - ], - "description": "Response mode passed to the authorization endpoint: - `query`: for parameters in query string - `form_post`: for parameters in request body - `fragment`: for parameters in uri fragment (rarely useful as the policy itself cannot read it) - `query.jwt`, `form_post.jwt`, `fragment.jwt`: similar to `query`, `form_post` and `fragment` but the parameters are encoded in a JWT - `jwt`: shortcut that indicates the default encoding for the requested response type.", - "default": "query" + "description": "The upstream introspection header." }, - "authorization_query_args_client": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra query arguments passed from the client to the authorization endpoint." + "issuer": { + "type": "string", + "description": "The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.", + "x-referenceable": true }, - "token_post_args_names": { + "authorization_query_args_values": { "type": "array", "items": { "type": "string" }, - "description": "Extra post argument names passed to the token endpoint." - }, - "introspection_endpoint_auth_method": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ], - "description": "The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" - }, - "downstream_id_token_jwk_header": { - "type": "string", - "description": "The downstream id token JWK header." + "description": "Extra query argument values passed to the authorization endpoint." }, - "display_errors": { + "hide_credentials": { "type": "boolean", - "description": "Display errors on failure responses.", - "default": false + "description": "Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the policy will remove those that were used for successful authentication.", + "default": true }, - "authorization_cookie_path": { - "type": "string", - "description": "The authorization cookie Path flag.", - "default": "/" + "timeout": { + "type": "number", + "description": "Network IO timeout in milliseconds.", + "default": 10000 }, - "authorization_cookie_same_site": { + "session_cookie_same_site": { "type": "string", "enum": [ "Default", @@ -891,468 +826,201 @@ "Strict" ], "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", - "default": "Default" - }, - "session_absolute_timeout": { - "type": "number", - "description": "Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", - "default": 86400 + "default": "Lax" }, - "upstream_refresh_token_header": { - "type": "string", - "description": "The upstream refresh token header." - }, - "consumer_groups_optional": { - "type": "boolean", - "description": "Do not terminate the request if consumer groups mapping fails.", - "default": false - }, - "preserve_query_args": { - "type": "boolean", - "description": "With this parameter, you can preserve request query arguments even when doing authorization code flow.", - "default": false - }, - "session_cookie_domain": { - "type": "string", - "description": "The session cookie Domain flag." - }, - "client_secret": { - "type": "array", - "items": { - "type": "string", - "x-referenceable": true - }, - "description": "The client secret.", - "x-encrypted": true - }, - "refresh_token_param_name": { - "type": "string", - "description": "The name of the parameter used to pass the refresh token." - }, - "upstream_headers": { - "type": "array", - "items": { - "type": "object", - "properties": { - "header": { - "type": "string", - "description": "The name of the header." - }, - "path": { - "type": "array", - "items": { - "type": "string" - }, - "minLength": 1, - "description": "The path of the header value." - } - }, - "required": [ - "header", - "path" - ] - }, - "description": "The upstream claim to header mappings." - }, - "upstream_access_token_header": { - "type": "string", - "description": "The upstream access token header.", - "default": "authorization:bearer" - }, - "http_proxy_authorization": { - "type": "string", - "description": "The HTTP proxy authorization.", - "x-referenceable": true - }, - "session_cookie_path": { - "type": "string", - "description": "The session cookie Path flag.", - "default": "/" - }, - "upstream_access_token_jwk_header": { - "type": "string", - "description": "The upstream access token JWK header." - }, - "introspection_token_param_name": { - "type": "string", - "description": "Designate token's parameter name for introspection.", - "default": "token" - }, - "forbidden_redirect_uri": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "description": "Where to redirect the client on forbidden requests." - }, - "session_store_metadata": { - "type": "boolean", - "description": "Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.", - "default": false - }, - "session_memcached_host": { - "type": "string", - "description": "The memcached host.", - "default": "127.0.0.1" - }, - "https_proxy": { - "type": "string", - "description": "The HTTPS proxy." - }, - "introspection_hint": { - "type": "string", - "description": "Introspection hint parameter value passed to the introspection endpoint.", - "default": "access_token" - }, - "logout_revoke_refresh_token": { - "type": "boolean", - "description": "Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.", - "default": true - }, - "keepalive": { - "type": "boolean", - "description": "Use keepalive with the HTTP client.", - "default": true - }, - "max_age": { - "type": "number", - "description": "The maximum age (in seconds) compared to the `auth_time` claim." - }, - "authenticated_groups_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim that contains authenticated groups. This setting can be used together with ACL policy, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload." - }, - "authorization_cookie_secure": { - "type": "boolean", - "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." - }, - "token_headers_values": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra header values passed to the token endpoint." - }, - "upstream_headers_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The upstream header names for the claim values." - }, - "downstream_introspection_header": { - "type": "string", - "description": "The downstream introspection header." - }, - "run_on_preflight": { - "type": "boolean", - "description": "Specifies whether to run this policy on pre-flight (`OPTIONS`) requests.", - "default": true - }, - "enable_hs_signatures": { - "type": "boolean", - "description": "Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).", - "default": false - }, - "session_remember": { - "type": "boolean", - "description": "Enables or disables persistent sessions.", - "default": false - }, - "session_memcached_ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to memcached" - }, - "reverify": { - "type": "boolean", - "description": "Specifies whether to always verify tokens stored in the session.", - "default": false - }, - "expose_error_code": { - "type": "boolean", - "description": "Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to `false` to disable.", - "default": true - }, - "token_post_args_client": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Pass extra arguments from the client to the OpenID-Connect policy. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with `scope` values, like this: `config.token_post_args_client=scope` In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint." - }, - "claims_forbidden": { - "type": "array", - "items": { - "type": "string" - }, - "description": "If given, these claims are forbidden in the token payload." - }, - "bearer_token_cookie_name": { - "type": "string", - "description": "The name of the cookie in which the bearer token is passed." - }, - "client_credentials_param_type": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "body", - "header", - "query" - ] - }, - "description": "Where to look for the client credentials: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search from the HTTP request body.", - "default": [ - "body", - "header", - "query" - ] - }, - "downstream_user_info_header": { - "type": "string", - "description": "The downstream user info header." - }, - "cache_token_exchange": { - "type": "boolean", - "description": "Cache the legacy token exchange endpoint requests.", - "default": true - }, - "forbidden_error_message": { - "type": "string", - "description": "The error message for the forbidden requests (when not using the redirection).", - "default": "Forbidden" - }, - "groups_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "groups" - ] - }, - "pushed_authorization_request_endpoint": { - "type": "string", - "description": "The pushed authorization endpoint. If set it overrides the value in `pushed_authorization_request_endpoint` returned by the discovery endpoint." - }, - "session_bind": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "ip", - "scheme", - "user-agent" - ] - }, - "description": "Bind the session to data acquired from the HTTP request or connection." - }, - "leeway": { - "type": "number", - "description": "Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims", - "default": 0 - }, - "verify_signature": { - "type": "boolean", - "description": "Verify the cryptographic signature of tokens. Disabling this skips verification for every token source, including tokens presented directly by clients (bearer); this is insecure for that path. To trust only tokens fetched from the identity provider for specific grants, use `ignore_signature` instead, which never affects bearer tokens.", - "default": true - }, - "token_post_args_values": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra post argument values passed to the token endpoint." - }, - "introspection_headers_values": { - "type": "array", - "items": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra header values passed to the introspection endpoint.", - "x-encrypted": true - }, - "no_proxy": { - "type": "string", - "description": "Do not use proxy with these hosts." - }, - "issuer": { - "type": "string", - "description": "The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure `config.using_pseudo_issuer=true`.", - "x-referenceable": true - }, - "unauthorized_destroy_session": { - "type": "boolean", - "description": "Destroy any active session for the unauthorized requests.", - "default": true - }, - "introspection_post_args_names": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra post argument names passed to the introspection endpoint." - }, - "session_enforce_same_subject": { - "type": "boolean", - "description": "When set to `true`, audiences are forced to share the same subject.", - "default": false - }, - "session_memcached_ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the memcached server SSL certificate", - "default": true - }, - "refresh_tokens": { - "type": "boolean", - "description": "Specifies whether the policy should try to refresh (soon to be) expired access tokens if the policy has a `refresh_token` available.", - "default": true - }, - "cache_ttl_neg": { - "type": "number", - "description": "The negative cache ttl in seconds." - }, - "audience_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "aud" - ] - }, - "userinfo_endpoint": { - "type": "string", - "description": "The user info endpoint. If set it overrides the value in `userinfo_endpoint` returned by the discovery endpoint." - }, - "unexpected_redirect_uri": { - "type": "array", - "items": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." - }, - "description": "Where to redirect the client when unexpected errors happen with the requests." - }, - "token_headers_replay": { + "upstream_headers_names": { "type": "array", "items": { "type": "string" }, - "description": "The names of token endpoint response headers to forward to the downstream client." - }, - "cache_ttl_min": { - "type": "number", - "description": "The minimum cache ttl in seconds (enforced)." - }, - "session_storage": { - "type": "string", - "enum": [ - "cookie", - "memcache", - "memcached", - "redis" - ], - "description": "The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.", - "default": "cookie" + "description": "The upstream header names for the claim values." }, - "upstream_user_info_header": { + "introspection_token_param_name": { "type": "string", - "description": "The upstream user info header." + "description": "Designate token's parameter name for introspection.", + "default": "token" }, - "revocation_endpoint_auth_method": { + "session_cookie_path": { "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ], - "description": "The revocation endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" - }, - "userinfo_query_args_client": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra query arguments passed from the client to the user info endpoint." - }, - "cache_introspection": { - "type": "boolean", - "description": "Cache the introspection endpoint requests.", - "default": true - }, - "dpop_proof_lifetime": { - "type": "number", - "description": "Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.", - "default": 300 + "description": "The session cookie Path flag.", + "default": "/" }, "cluster_cache_redis": { "type": "object", "properties": { - "keepalive_backlog": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "send_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, - "sentinel_master": { + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 }, "server_name": { "type": "string", "description": "A string representing an SNI (server name indication) value for TLS.", "x-referenceable": true }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + }, + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, "connection_is_proxied": { "type": "boolean", "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", "default": false }, - "sentinel_password": { + "sentinel_username": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true }, "cloud_authentication": { "type": "object", "properties": { - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_secret_access_key": { + "azure_client_id": { "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_assume_role_arn": { + "azure_client_secret": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "aws_cache_name": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, @@ -1362,18 +1030,6 @@ "x-referenceable": true, "x-encrypted": true }, - "azure_client_id": { - "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, "auth_provider": { "type": "string", "enum": [ @@ -1384,31 +1040,36 @@ "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_cache_name": { + "aws_region": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_access_key_id": { + "aws_secret_access_key": { "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_secret": { + "aws_assume_role_arn": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, - "aws_region": { + "aws_role_session_name": { "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, "sentinel_role": { "type": "string", "enum": [ @@ -1418,158 +1079,154 @@ ], "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, - "sentinel_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true - }, "ssl": { "type": "boolean", "description": "If set to true, uses SSL to connect to Redis.", "default": false - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 } } }, - "userinfo_headers_names": { + "authorization_cookie_http_only": { + "type": "boolean", + "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", + "default": true + }, + "token_headers_values": { "type": "array", "items": { "type": "string" }, - "description": "Extra header names passed to the user info endpoint." + "description": "Extra header values passed to the token endpoint." }, - "password_param_type": { + "login_methods": { "type": "array", "items": { "type": "string", "enum": [ - "body", - "header", - "query" + "authorization_code", + "bearer", + "client_credentials", + "introspection", + "kong_oauth2", + "password", + "refresh_token", + "session", + "userinfo" ] }, - "description": "Where to look for the username and password: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "description": "Enable login functionality with specified grants.", "default": [ - "body", - "header", - "query" + "authorization_code" ] }, - "verify_claims": { + "tls_client_auth_cert_id": { + "type": "string", + "description": "ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server." + }, + "upstream_headers_claims": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The upstream header claims. Only top level claims are supported." + }, + "unauthorized_error_message": { + "type": "string", + "description": "The error message for the unauthorized requests (when not using the redirection).", + "default": "Unauthorized" + }, + "require_proof_key_for_code_exchange": { "type": "boolean", - "description": "Verify tokens for standard claims.", + "description": "Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of `code_challenge_methods_supported`, and enabled automatically (in case the `code_challenge_methods_supported` is missing, the PKCE will not be enabled)." + }, + "session_memcached_ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the memcached server SSL certificate", + "default": true + }, + "jwt_session_cookie": { + "type": "string", + "description": "The name of the JWT session cookie." + }, + "pushed_authorization_request_endpoint_auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" + ], + "description": "The pushed authorization request endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" + }, + "token_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header names passed to the token endpoint." + }, + "session_rolling_timeout": { + "type": "number", + "description": "Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", + "default": 3600 + }, + "logout_revoke_refresh_token": { + "type": "boolean", + "description": "Revoke the refresh token as part of the logout. Requires `logout_revoke` to be set to `true`.", "default": true }, - "revocation_token_param_name": { - "type": "string", - "description": "Designate token's parameter name for revocation.", - "default": "token" + "jwks_endpoint": { + "type": "string", + "description": "Overrides the `jwks_uri` returned by discovery. Use when the IdP exposes a non-standard JWKS endpoint." + }, + "refresh_token_param_name": { + "type": "string", + "description": "The name of the parameter used to pass the refresh token." + }, + "revocation_token_param_name": { + "type": "string", + "description": "Designate token's parameter name for revocation.", + "default": "token" + }, + "domains": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The allowed values for the `hd` claim." + }, + "require_pushed_authorization_requests": { + "type": "boolean", + "description": "Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of `require_pushed_authorization_requests` (which defaults to `false`)." + }, + "session_remember_rolling_timeout": { + "type": "number", + "description": "Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.", + "default": 604800 + }, + "reverify": { + "type": "boolean", + "description": "Specifies whether to always verify tokens stored in the session.", + "default": false + }, + "consumer_claims": { + "type": "array", + "items": { + "type": "array", + "items": { + "type": "string" + }, + "description": "A path of strings representing the location of the claim in a nested object. For example, to map to `user.info.id`, set `[ \"user\", \"info\", \"id\" ]`." + }, + "description": "The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used." + }, + "cache_ttl": { + "type": "number", + "description": "The default cache ttl in seconds that is used in case the cached object does not specify the expiry.", + "default": 3600 }, "redirect_uri": { "type": "array", @@ -1579,142 +1236,130 @@ }, "description": "The redirect URI passed to the authorization and token endpoints." }, - "forbidden_destroy_session": { - "type": "boolean", - "description": "Destroy any active session for the forbidden requests.", - "default": true - }, - "unauthorized_redirect_uri": { + "unexpected_redirect_uri": { "type": "array", "items": { "type": "string", "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." }, - "description": "Where to redirect the client on unauthorized requests." - }, - "roles_required": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." - }, - "introspection_headers_client": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Extra headers passed from the client to the introspection endpoint." + "description": "Where to redirect the client when unexpected errors happen with the requests." }, - "session_remember_rolling_timeout": { - "type": "number", - "description": "Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.", - "default": 604800 + "run_on_preflight": { + "type": "boolean", + "description": "Specifies whether to run this policy on pre-flight (`OPTIONS`) requests.", + "default": true }, - "cache_ttl_max": { + "http_version": { "type": "number", - "description": "The maximum cache ttl in seconds (enforced)." + "description": "The HTTP version used for the requests by this policy: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.", + "default": 1.1 }, - "cache_ttl_resurrect": { - "type": "number", - "description": "The resurrection ttl in seconds." + "mtls_token_endpoint": { + "type": "string", + "description": "Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." }, - "issuers_allowed": { + "client_secret": { "type": "array", "items": { "type": "string", "x-referenceable": true }, - "description": "The issuers allowed to be present in the tokens (`iss` claim)." - }, - "ssl_verify": { - "type": "boolean", - "description": "Verify identity provider server certificate. If set to `true`, the policy uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.", - "default": true + "description": "The client secret.", + "x-encrypted": true }, - "client_auth": { + "authorization_query_args_client": { "type": "array", "items": { - "type": "string", - "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none", - "private_key_jwt", - "self_signed_tls_client_auth", - "tls_client_auth" - ] + "type": "string" }, - "description": "The default OpenID Connect client authentication method is 'client_secret_basic' (using 'Authorization: Basic' header), 'client_secret_post' (credentials in body), 'client_secret_jwt' (signed client assertion in body), 'private_key_jwt' (private key-signed assertion), 'tls_client_auth' (client certificate), 'self_signed_tls_client_auth' (self-signed client certificate), and 'none' (no authentication)." + "description": "Extra query arguments passed from the client to the authorization endpoint." }, - "introspection_check_active": { - "type": "boolean", - "description": "Check that the introspection response has an `active` claim with a value of `true`.", - "default": true + "token_endpoint_auth_method": { + "type": "string", + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" + ], + "description": "The token endpoint authentication method: `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" }, - "session_idling_timeout": { - "type": "number", - "description": "Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.", - "default": 900 + "session_secret": { + "type": "string", + "description": "The session secret.", + "x-referenceable": true, + "x-encrypted": true }, - "token_cache_key_include_scope": { + "refresh_tokens": { "type": "boolean", - "description": "Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.", - "default": false - }, - "authorization_rolling_timeout": { - "type": "number", - "description": "Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", - "default": 600 + "description": "Specifies whether the policy should try to refresh (soon to be) expired access tokens if the policy has a `refresh_token` available.", + "default": true }, - "upstream_introspection_header": { + "downstream_introspection_jwt_header": { "type": "string", - "description": "The upstream introspection header." + "description": "The downstream introspection JWT header." }, - "hide_credentials": { + "logout_revoke_access_token": { "type": "boolean", - "description": "Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the policy will remove those that were used for successful authentication.", + "description": "Revoke the access token as part of the logout. Requires `logout_revoke` to be set to `true`.", "default": true }, - "introspection_post_args_client": { + "discovery_headers_values": { "type": "array", "items": { "type": "string" }, - "description": "Extra post arguments passed from the client to the introspection endpoint." + "description": "Extra header values passed to the discovery endpoint." }, - "upstream_session_id_header": { + "client_arg": { "type": "string", - "description": "The upstream session id header." + "description": "The client to use for this request (the selection is made with a request parameter with the same name).", + "default": "client_id" }, - "login_tokens": { + "forbidden_error_message": { + "type": "string", + "description": "The error message for the forbidden requests (when not using the redirection).", + "default": "Forbidden" + }, + "userinfo_headers_values": { "type": "array", "items": { - "type": "string", - "enum": [ - "access_token", - "id_token", - "introspection", - "refresh_token", - "tokens" - ] + "type": "string" }, - "description": "What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.", - "default": [ - "id_token" - ] + "description": "Extra header values passed to the user info endpoint." }, - "credential_claim": { + "claims_forbidden": { "type": "array", "items": { "type": "string" }, - "description": "The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting policy), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "description": "If given, these claims are forbidden in the token payload." + }, + "cache_user_info": { + "type": "boolean", + "description": "Cache the user info requests.", + "default": true + }, + "scopes_claim": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.", "default": [ - "sub" + "scope" ] }, + "authorization_query_args_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra query argument names passed to the authorization endpoint." + }, "ignore_signature": { "type": "array", "items": { @@ -1732,92 +1377,201 @@ "description": "Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.", "default": [] }, - "token_headers_grants": { + "preserve_query_args": { + "type": "boolean", + "description": "With this parameter, you can preserve request query arguments even when doing authorization code flow.", + "default": false + }, + "id_token_param_type": { "type": "array", "items": { "type": "string", "enum": [ - "authorization_code", - "client_credentials", - "password", - "refresh_token" + "body", + "header", + "query" ] }, - "description": "Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant." + "description": "Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] }, - "downstream_headers_claims": { + "cache_introspection": { + "type": "boolean", + "description": "Cache the introspection endpoint requests.", + "default": true + }, + "authorization_cookie_same_site": { + "type": "string", + "enum": [ + "Default", + "Lax", + "None", + "Strict" + ], + "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", + "default": "Default" + }, + "userinfo_accept": { + "type": "string", + "enum": [ + "application/json", + "application/jwt" + ], + "description": "The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).", + "default": "application/json" + }, + "userinfo_query_args_values": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra query argument values passed to the user info endpoint." + }, + "downstream_id_token_jwk_header": { + "type": "string", + "description": "The downstream id token JWK header." + }, + "consumer_groups_claim": { "type": "array", "items": { "type": "string" }, - "description": "The downstream header claims. Only top level claims are supported." + "description": "The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload." + }, + "dpop_use_nonce": { + "type": "boolean", + "description": "Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.", + "default": false + }, + "cache_tokens": { + "type": "boolean", + "description": "Cache the token endpoint requests.", + "default": true + }, + "keepalive": { + "type": "boolean", + "description": "Use keepalive with the HTTP client.", + "default": true + }, + "forbidden_redirect_uri": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." + }, + "description": "Where to redirect the client on forbidden requests." }, - "downstream_refresh_token_header": { + "authorization_cookie_path": { "type": "string", - "description": "The downstream refresh token header." + "description": "The authorization cookie Path flag.", + "default": "/" }, - "downstream_user_info_jwt_header": { - "type": "string", - "description": "The downstream user info JWT header (in case the user info returns a JWT response)." + "session_cookie_http_only": { + "type": "boolean", + "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", + "default": true }, - "mtls_revocation_endpoint": { + "downstream_id_token_header": { "type": "string", - "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." + "description": "The downstream id token header." }, - "userinfo_accept": { - "type": "string", - "enum": [ - "application/json", - "application/jwt" - ], - "description": "The value of `Accept` header for user info requests: - `application/json`: user info response as JSON - `application/jwt`: user info response as JWT (from the obsolete IETF draft document).", - "default": "application/json" + "consumer_groups_optional": { + "type": "boolean", + "description": "Do not terminate the request if consumer groups mapping fails.", + "default": false }, - "userinfo_query_args_values": { + "audience_claim": { "type": "array", "items": { "type": "string" }, - "description": "Extra query argument values passed to the user info endpoint." + "description": "The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "aud" + ] }, - "session_hash_subject": { - "type": "boolean", - "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.", - "default": false + "refresh_token_param_type": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ] + }, + "description": "Where to look for the refresh token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "default": [ + "body", + "header", + "query" + ] }, - "session_memcached_socket": { + "authorization_cookie_name": { "type": "string", - "description": "The memcached unix socket path." + "description": "The authorization cookie name.", + "default": "authorization" + }, + "session_remember_cookie_name": { + "type": "string", + "description": "Persistent session cookie name. Use with the `remember` configuration parameter.", + "default": "remember" }, "redis": { "type": "object", "properties": { - "sentinel_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true }, - "ssl": { + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "ssl_verify": { "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true }, "connect_timeout": { "type": "integer", @@ -1833,15 +1587,25 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "password": { + "username": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-encrypted": true, + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true }, "cloud_authentication": { "type": "object", "properties": { + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, "aws_assume_role_arn": { "type": "string", "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", @@ -1860,60 +1624,49 @@ "x-referenceable": true, "x-encrypted": true }, - "azure_client_secret": { + "azure_tenant_id": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "auth_provider": { + "aws_region": { "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_access_key_id": { + "aws_secret_access_key": { "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, "aws_role_session_name": { "type": "string", "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, - "azure_tenant_id": { + "azure_client_secret": { "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_cache_name": { + "auth_provider": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_region": { + "aws_cache_name": { "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." @@ -1946,63 +1699,9 @@ "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, "prefix": { "type": "string", - "description": "The Redis session key prefix." - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "socket": { - "type": "string", - "description": "The Redis unix socket path." - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true + "description": "The Redis session key prefix." }, "port": { "type": "integer", @@ -2012,20 +1711,44 @@ "default": 6379, "x-referenceable": true }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false }, "sentinel_role": { "type": "string", @@ -2035,152 +1758,485 @@ "slave" ], "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "socket": { + "type": "string", + "description": "The Redis unix socket path." } } }, - "downstream_id_token_header": { + "https_proxy": { "type": "string", - "description": "The downstream id token header." + "description": "The HTTPS proxy." }, - "using_pseudo_issuer": { + "login_redirect_uri": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "x-referenceable": true + }, + "description": "Where to redirect the client when `login_action` is set to `redirect`." + }, + "introspection_check_active": { "type": "boolean", - "description": "If the policy uses a pseudo issuer. When set to true, the policy will not discover the configuration from the issuer URL specified with `config.issuer`.", + "description": "Check that the introspection response has an `active` claim with a value of `true`.", + "default": true + }, + "token_exchange_endpoint": { + "type": "string", + "description": "Endpoint used to perform the legacy token exchange." + }, + "login_redirect_mode": { + "type": "string", + "enum": [ + "fragment", + "query" + ], + "description": "Where to place `login_tokens` when using `redirect` `login_action`: - `query`: place tokens in query string - `fragment`: place tokens in url fragment (not readable by servers).", + "default": "fragment" + }, + "anonymous": { + "type": "string", + "description": "An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." + }, + "scopes_required": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." + }, + "introspection_endpoint": { + "type": "string", + "description": "The introspection endpoint. If set it overrides the value in `introspection_endpoint` returned by the discovery endpoint.", + "x-referenceable": true + }, + "login_tokens": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "access_token", + "id_token", + "introspection", + "refresh_token", + "tokens" + ] + }, + "description": "What tokens to include in `response` body or `redirect` query string or fragment: - `id_token`: include id token - `access_token`: include access token - `refresh_token`: include refresh token - `tokens`: include the full token endpoint response - `introspection`: include introspection response.", + "default": [ + "id_token" + ] + }, + "token_cache_key_include_scope": { + "type": "boolean", + "description": "Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.", "default": false }, - "authorization_query_args_values": { + "tls_client_auth_ssl_verify": { + "type": "boolean", + "description": "Verify identity provider server certificate during mTLS client authentication.", + "default": true + }, + "cluster_cache_strategy": { + "type": "string", + "enum": [ + "off", + "redis" + ], + "description": "The strategy to use for the cluster cache. If set, the policy will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.", + "default": "off" + }, + "session_request_headers": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "absolute-timeout", + "audience", + "id", + "idling-timeout", + "rolling-timeout", + "subject", + "timeout" + ] + }, + "description": "Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout request headers." + }, + "session_audience": { + "type": "string", + "description": "The session audience, which is the intended target application. For example `\"my-application\"`.", + "default": "default" + }, + "session_storage": { + "type": "string", + "enum": [ + "cookie", + "memcache", + "memcached", + "redis" + ], + "description": "The session storage for session data: - `cookie`: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) - `memcache`: stores session data in memcached - `redis`: stores session data in Redis.", + "default": "cookie" + }, + "upstream_access_token_jwk_header": { + "type": "string", + "description": "The upstream access token JWK header." + }, + "verify_nonce": { + "type": "boolean", + "description": "Verify nonce on authorization code flow.", + "default": true + }, + "ssl_verify": { + "type": "boolean", + "description": "Verify identity provider server certificate. If set to `true`, the policy uses the CA certificate set in the `kong.conf` config parameter `lua_ssl_trusted_certificate`.", + "default": true + }, + "extra_jwks_uris": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "x-referenceable": true + }, + "description": "JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery)." + }, + "token_post_args_client": { "type": "array", "items": { "type": "string" }, - "description": "Extra query argument values passed to the authorization endpoint." + "description": "Pass extra arguments from the client to the OpenID-Connect policy. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with `scope` values, like this: `config.token_post_args_client=scope` In this case, the token would take the `scope` value from the query parameter or from the request body or from the header and send it to the token endpoint." + }, + "session_response_headers": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "absolute-timeout", + "audience", + "id", + "idling-timeout", + "rolling-timeout", + "subject", + "timeout" + ] + }, + "description": "Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. `[ \"id\", \"timeout\" ]` will set Session-Id and Session-Timeout response headers." + }, + "upstream_refresh_token_header": { + "type": "string", + "description": "The upstream refresh token header." + }, + "downstream_refresh_token_header": { + "type": "string", + "description": "The downstream refresh token header." + }, + "session_memcached_prefix": { + "type": "string", + "description": "The memcached session key prefix." + }, + "logout_methods": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "DELETE", + "GET", + "POST" + ] + }, + "description": "The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.", + "default": [ + "DELETE", + "POST" + ] + }, + "cache_ttl_max": { + "type": "number", + "description": "The maximum cache ttl in seconds (enforced)." + }, + "protected_resource_metadata": { + "type": "object", + "properties": { + "resource": { + "type": "string", + "description": "The URI of the protected resource. Used as the resource field in the RFC 9728 metadata document and to derive the well-known endpoint path." + }, + "authorization_servers": { + "type": "array", + "items": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." + }, + "minLength": 1, + "description": "List of authorization server issuer URIs to advertise in the RFC 9728 metadata document." + }, + "scopes_supported": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "description": "Scopes supported by this protected resource. Included in the RFC 9728 metadata document and in the scope attribute of WWW-Authenticate challenge headers on 401 responses." + }, + "metadata_endpoint": { + "type": "string", + "description": "Override the well-known metadata endpoint path. Defaults to the path component of resource with /.well-known/oauth-protected-resource appended." + } + }, + "required": [ + "authorization_servers", + "resource" + ], + "description": "When configured, the policy advertises this API as an OAuth 2.0 protected resource per RFC 9728. It serves a discovery document at the well-known URI and includes resource_metadata in WWW-Authenticate challenge headers." }, - "userinfo_headers_values": { + "token_headers_grants": { "type": "array", "items": { - "type": "string" + "type": "string", + "enum": [ + "authorization_code", + "client_credentials", + "password", + "refresh_token" + ] }, - "description": "Extra header values passed to the user info endpoint." + "description": "Enable the sending of the token endpoint response headers only with certain grants: - `password`: with OAuth password grant - `client_credentials`: with OAuth client credentials grant - `authorization_code`: with authorization code flow - `refresh_token` with refresh token grant." }, - "logout_revoke": { - "type": "boolean", - "description": "Revoke tokens as part of the logout.\n\nFor more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.", - "default": false + "session_cookie_name": { + "type": "string", + "description": "The session cookie name.", + "default": "session" }, - "disable_session": { + "session_memcached_host": { + "type": "string", + "description": "The memcached host.", + "default": "127.0.0.1" + }, + "consumer_by": { "type": "array", "items": { "type": "string", "enum": [ - "authorization_code", - "bearer", - "client_credentials", - "introspection", - "kong_oauth2", - "password", - "refresh_token", - "session", - "userinfo" + "custom_id", + "id", + "username" ] }, - "description": "Disable issuing the session cookie with the specified grants." + "description": "Consumer fields used for mapping: - `id`: try to find the matching Consumer by `id` - `username`: try to find the matching Consumer by `username` - `custom_id`: try to find the matching Consumer by `custom_id`.", + "default": [ + "custom_id", + "username" + ] }, - "rediscovery_lifetime": { - "type": "number", - "description": "Specifies how long (in seconds) the policy waits between discovery attempts. Discovery is still triggered on an as-needed basis.", - "default": 30 + "no_proxy": { + "type": "string", + "description": "Do not use proxy with these hosts." }, - "client_arg": { + "using_pseudo_issuer": { + "type": "boolean", + "description": "If the policy uses a pseudo issuer. When set to true, the policy will not discover the configuration from the issuer URL specified with `config.issuer`.", + "default": false + }, + "require_signed_request_object": { + "type": "boolean", + "description": "Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of `require_signed_request_object`, and enabled automatically (in case the `require_signed_request_object` is missing, the feature will not be enabled)." + }, + "introspection_hint": { "type": "string", - "description": "The client to use for this request (the selection is made with a request parameter with the same name).", - "default": "client_id" + "description": "Introspection hint parameter value passed to the introspection endpoint.", + "default": "access_token" }, - "authorization_cookie_name": { + "downstream_access_token_jwk_header": { "type": "string", - "description": "The authorization cookie name.", - "default": "authorization" + "description": "The downstream access token JWK header." }, - "session_remember_cookie_name": { + "authorization_cookie_domain": { "type": "string", - "description": "Persistent session cookie name. Use with the `remember` configuration parameter.", - "default": "remember" + "description": "The authorization cookie Domain flag." }, - "session_cookie_secure": { + "session_enforce_same_subject": { "type": "boolean", - "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." + "description": "When set to `true`, audiences are forced to share the same subject.", + "default": false }, - "logout_methods": { + "bearer_token_cookie_name": { + "type": "string", + "description": "The name of the cookie in which the bearer token is passed." + }, + "principals": { + "type": "object", + "properties": { + "principal_by": { + "type": "string", + "minLength": 1, + "description": "Custom identity name for a type=custom Kong Identity lookup. When absent and principal_claim is set, an OIDC lookup is performed using principal_claim as the claim name instead of 'sub'." + }, + "principal_claim": { + "type": "array", + "items": { + "type": "string", + "minLength": 1 + }, + "minLength": 1, + "description": "Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'." + }, + "match_consumer": { + "type": "boolean", + "description": "If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by.", + "default": true + }, + "match_consumer_groups": { + "type": "boolean", + "description": "If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumer_groups_claim.", + "default": true + }, + "error_on_miss": { + "type": "boolean", + "description": "When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set.", + "default": true + }, + "enabled": { + "type": "boolean", + "description": "When true, query Kong Identity to map a Principal after token verification.", + "default": false + }, + "directory": { + "type": "string", + "description": "The Kong Identity directory instance to look up against.", + "default": "default" + } + }, + "description": "Configuration for Kong Identity principal hydration after token verification." + }, + "discovery_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra header names passed to the discovery endpoint." + }, + "scopes": { "type": "array", "items": { "type": "string", - "enum": [ - "DELETE", - "GET", - "POST" - ] + "x-referenceable": true }, - "description": "The request methods that can activate the logout: - `POST`: HTTP POST method - `GET`: HTTP GET method - `DELETE`: HTTP DELETE method.", + "description": "The scopes passed to the authorization and token endpoints.", "default": [ - "DELETE", - "POST" + "openid" ] }, - "consumer_claims": { + "groups_claim": { "type": "array", "items": { - "type": "array", - "items": { - "type": "string" - }, - "description": "A path of strings representing the location of the claim in a nested object. For example, to map to `user.info.id`, set `[ \"user\", \"info\", \"id\" ]`." + "type": "string" }, - "description": "The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used." + "description": "The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.", + "default": [ + "groups" + ] }, - "anonymous": { + "upstream_user_info_jwt_header": { "type": "string", - "description": "An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a `4xx` HTTP status code. This value must refer to the consumer `id` or `username` attribute, and **not** its `custom_id`." + "description": "The upstream user info JWT header (in case the user info returns a JWT response)." }, - "scopes_required": { + "roles_required": { "type": "array", "items": { "type": "string" }, - "description": "The scopes (`scopes_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." + "description": "The roles (`roles_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." }, - "groups_required": { + "token_post_args_names": { "type": "array", "items": { "type": "string" }, - "description": "The groups (`groups_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." + "description": "Extra post argument names passed to the token endpoint." }, - "authorization_cookie_http_only": { + "session_hash_storage_key": { "type": "boolean", - "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", - "default": true + "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.", + "default": false }, - "end_session_endpoint": { + "id_token_param_name": { "type": "string", - "description": "The end session endpoint. If set it overrides the value in `end_session_endpoint` returned by the discovery endpoint." + "description": "The name of the parameter used to pass the id token." }, - "jwt_session_claim": { + "cache_token_exchange": { + "type": "boolean", + "description": "Cache the legacy token exchange endpoint requests.", + "default": true + }, + "expose_error_code": { + "type": "boolean", + "description": "Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to `false` to disable.", + "default": true + }, + "downstream_headers_names": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The downstream header names for the claim values." + }, + "auth_methods": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "authorization_code", + "bearer", + "client_credentials", + "introspection", + "kong_oauth2", + "password", + "refresh_token", + "session", + "userinfo" + ] + }, + "description": "Types of credentials/grants to enable.", + "default": [ + "authorization_code", + "bearer", + "client_credentials", + "introspection", + "kong_oauth2", + "password", + "refresh_token", + "session", + "userinfo" + ] + }, + "userinfo_query_args_client": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Extra query arguments passed from the client to the user info endpoint." + }, + "mtls_revocation_endpoint": { "type": "string", - "description": "The claim to match against the JWT session cookie.", - "default": "sid" + "description": "Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in `mtls_endpoint_aliases` returned by the discovery endpoint." }, - "http_version": { + "session_remember_absolute_timeout": { "type": "number", - "description": "The HTTP version used for the requests by this policy: - `1.1`: HTTP 1.1 (the default) - `1.0`: HTTP 1.0.", - "default": 1.1 + "description": "Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", + "default": 2592000 }, - "proof_of_possession_mtls": { - "type": "string", - "enum": [ - "off", - "optional", - "strict" - ], - "description": "Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.", - "default": "off" + "session_memcached_ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to memcached" }, "token_headers_client": { "type": "array", @@ -2189,192 +2245,171 @@ }, "description": "Extra headers passed from the client to the token endpoint." }, - "id_token_param_type": { + "session_store_metadata": { + "type": "boolean", + "description": "Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.", + "default": false + }, + "bearer_token_param_type": { "type": "array", "items": { "type": "string", "enum": [ "body", + "cookie", "header", "query" ] }, - "description": "Where to look for the id token: - `header`: search the HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body.", + "description": "Where to look for the bearer token: - `header`: search the `Authorization`, `access-token`, and `x-access-token` HTTP headers - `query`: search the URL's query string - `body`: search the HTTP request body - `cookie`: search the HTTP request cookies specified with `config.bearer_token_cookie_name`.", "default": [ "body", "header", "query" ] }, - "roles_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.", - "default": [ - "roles" - ] - }, - "session_memcached_prefix": { - "type": "string", - "description": "The memcached session key prefix." - }, - "consumer_groups_claim": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload." + "verify_signature": { + "type": "boolean", + "description": "Verify the cryptographic signature of tokens. Disabling this skips verification for every token source, including tokens presented directly by clients (bearer); this is insecure for that path. To trust only tokens fetched from the identity provider for specific grants, use `ignore_signature` instead, which never affects bearer tokens.", + "default": true }, - "session_remember_absolute_timeout": { + "leeway": { "type": "number", - "description": "Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.", - "default": 2592000 + "description": "Defines leeway time (in seconds) for `auth_time`, `exp`, `iat`, and `nbf` claims", + "default": 0 }, - "https_proxy_authorization": { + "cache_tokens_salt": { "type": "string", - "description": "The HTTPS proxy authorization.", - "x-referenceable": true + "description": "Salt used for generating the cache key that is used for caching the token endpoint requests." }, - "introspection_post_args_client_headers": { + "unauthorized_redirect_uri": { "type": "array", "items": { - "type": "string" + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." }, - "description": "Extra post arguments passed from the client headers to the introspection endpoint." + "description": "Where to redirect the client on unauthorized requests." }, - "session_cookie_name": { + "authorization_endpoint": { "type": "string", - "description": "The session cookie name.", - "default": "session" + "description": "The authorization endpoint. If set it overrides the value in `authorization_endpoint` returned by the discovery endpoint." }, - "token_headers_prefix": { + "introspection_endpoint_auth_method": { "type": "string", - "description": "Add a prefix to the token endpoint response headers before forwarding them to the downstream client." + "enum": [ + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none", + "private_key_jwt", + "self_signed_tls_client_auth", + "tls_client_auth" + ], + "description": "The introspection endpoint authentication method: : `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, or `none`: do not authenticate" }, - "jwt_session_cookie": { + "downstream_access_token_header": { "type": "string", - "description": "The name of the JWT session cookie." - }, - "principals": { - "type": "object", - "properties": { - "principal_by": { - "type": "string", - "minLength": 1, - "description": "Custom identity name for a type=custom Kong Identity lookup. When absent and principal_claim is set, an OIDC lookup is performed using principal_claim as the claim name instead of 'sub'." - }, - "principal_claim": { - "type": "array", - "items": { - "type": "string", - "minLength": 1 - }, - "minLength": 1, - "description": "Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'." - }, - "match_consumer": { - "type": "boolean", - "description": "If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by.", - "default": true - }, - "match_consumer_groups": { - "type": "boolean", - "description": "If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumer_groups_claim.", - "default": true - }, - "error_on_miss": { - "type": "boolean", - "description": "When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set.", - "default": true - }, - "enabled": { - "type": "boolean", - "description": "When true, query Kong Identity to map a Principal after token verification.", - "default": false - }, - "directory": { - "type": "string", - "description": "The Kong Identity directory instance to look up against.", - "default": "default" - } - }, - "description": "Configuration for Kong Identity principal hydration after token verification." - }, - "verify_nonce": { - "type": "boolean", - "description": "Verify nonce on authorization code flow.", - "default": true + "description": "The downstream access token header." }, - "cache_tokens": { + "logout_revoke": { "type": "boolean", - "description": "Cache the token endpoint requests.", - "default": true + "description": "Revoke tokens as part of the logout.\n\nFor more granular token revocation, you can also adjust the `logout_revoke_access_token` and `logout_revoke_refresh_token` parameters.", + "default": false }, - "login_redirect_uri": { + "client_alg": { "type": "array", "items": { "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", - "x-referenceable": true + "enum": [ + "ES256", + "ES384", + "ES512", + "EdDSA", + "HS256", + "HS384", + "HS512", + "PS256", + "PS384", + "PS512", + "RS256", + "RS384", + "RS512" + ] }, - "description": "Where to redirect the client when `login_action` is set to `redirect`." - }, - "unauthorized_error_message": { - "type": "string", - "description": "The error message for the unauthorized requests (when not using the redirection).", - "default": "Unauthorized" + "description": "The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication." }, "downstream_session_id_header": { "type": "string", "description": "The downstream session id header." }, - "cluster_cache_strategy": { - "type": "string", - "enum": [ - "off", - "redis" - ], - "description": "The strategy to use for the cluster cache. If set, the policy will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.", - "default": "off" - }, - "authorization_cookie_domain": { - "type": "string", - "description": "The authorization cookie Domain flag." - }, - "introspection_post_args_values": { + "groups_required": { "type": "array", "items": { "type": "string" }, - "description": "Extra post argument values passed to the introspection endpoint." - }, - "session_rolling_timeout": { - "type": "number", - "description": "Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.", - "default": 3600 + "description": "The groups (`groups_claim` claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both **AND** / **OR** cases." }, - "scopes": { + "token_headers_replay": { "type": "array", "items": { - "type": "string", - "x-referenceable": true + "type": "string" }, - "description": "The scopes passed to the authorization and token endpoints.", - "default": [ - "openid" - ] + "description": "The names of token endpoint response headers to forward to the downstream client." }, - "token_endpoint": { + "introspection_accept": { "type": "string", - "description": "The token endpoint. If set it overrides the value in `token_endpoint` returned by the discovery endpoint." + "enum": [ + "application/json", + "application/jwt", + "application/token-introspection+jwt" + ], + "description": "The value of `Accept` header for introspection requests: - `application/json`: introspection response as JSON - `application/token-introspection+jwt`: introspection response as JWT (from the current IETF draft document) - `application/jwt`: introspection response as JWT (from the obsolete IETF draft document).", + "default": "application/json" + }, + "jwt_session_claim": { + "type": "string", + "description": "The claim to match against the JWT session cookie.", + "default": "sid" + }, + "search_user_info": { + "type": "boolean", + "description": "Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.", + "default": false + }, + "authorization_cookie_secure": { + "type": "boolean", + "description": "Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." + }, + "upstream_id_token_header": { + "type": "string", + "description": "The upstream id token header." } }, "required": [ "issuer" ] }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "ws", + "wss" + ] + }, + "description": "A list of the request protocols that will trigger this policy. The default value, as well as the possible values allowed on this field, may change depending on the policy type. For example, policies that only work in stream mode will only support tcp and tls.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/Opentelemetry.json b/app/_schemas/ai-gateway/policies/Opentelemetry.json index e764571ee55..23461c2e5c6 100644 --- a/app/_schemas/ai-gateway/policies/Opentelemetry.json +++ b/app/_schemas/ai-gateway/policies/Opentelemetry.json @@ -1,98 +1,143 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "tcp", - "tls", - "tls_passthrough", - "udp", - "ws", - "wss" - ], - "description": "A string representing a protocol, such as HTTP or HTTPS." - }, - "description": "A set of strings representing protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "traces_endpoint": { + "logs_endpoint": { "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", + "description": "An HTTP URL endpoint where internal logs are exported.", "x-referenceable": true }, - "metrics": { + "headers": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "The custom headers to be added in the HTTP request sent to the OTLP server. This setting is useful for adding the authentication headers (token) for the APM backend." + }, + "resource_attributes": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-lua-required": true + } + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 5000 + }, + "sampling_rate": { + "type": "number", + "maximum": 1, + "minimum": 0, + "description": "Tracing sampling rate for configuring the probability-based sampler. When set, this value supersedes the global `tracing_sampling_rate` setting from kong.conf." + }, + "propagation": { "type": "object", "properties": { - "endpoint": { - "type": "string", - "description": "An HTTP URL endpoint where metrics are exported.", - "x-referenceable": true - }, - "push_interval": { - "type": "number", - "description": "The interval in seconds at which metrics are pushed to the OTLP server. This setting is only applicable when `endpoint` is set.", - "default": 60 - }, - "enable_consumer_attribute": { - "type": "boolean", - "description": "A boolean value that determines if `http.server.request.count`, `http.server.request.size` and `http.server.response.size` metrics should fill in the consumer attribute when available.", - "default": false - }, - "enable_request_metrics": { - "type": "boolean", - "description": "A boolean value that determines if request count metrics should be collected. If enabled, `http.server.request.count` metrics will be exported.", - "default": false - }, - "enable_bandwidth_metrics": { - "type": "boolean", - "description": "A boolean value that determines if bandwidth metrics should be collected. If enabled, `http.server.request.size` and `http.server.response.size` metrics will be exported.", - "default": false + "inject": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "aws", + "b3", + "b3-single", + "datadog", + "gcp", + "instana", + "jaeger", + "ot", + "preserve", + "w3c" + ] + }, + "description": "Header formats used to inject tracing context. The value `preserve` will use the same header format as the incoming request. If multiple values are specified, all of them will be used during injection. If left empty, Kong will not inject any tracing context information in outgoing requests." }, - "enable_latency_metrics": { - "type": "boolean", - "description": "A boolean value that determines if latency metrics should be collected. If enabled, `kong.latency.total`, `kong.latency.internal` and `kong.latency.upstream` metrics will be exported.", - "default": false + "default_format": { + "type": "string", + "enum": [ + "aws", + "b3", + "b3-single", + "datadog", + "gcp", + "instana", + "jaeger", + "ot", + "w3c" + ], + "description": "The default header format to use when extractors did not match any format in the incoming headers and `inject` is configured with the value: `preserve`. This can happen when no tracing header was found in the request, or the incoming tracing header formats were not included in `extract`.", + "default": "w3c" }, - "enable_upstream_health_metrics": { - "type": "boolean", - "description": "A boolean value that determines if upstream health metrics should be collected. If enabled, `kong.upstream.target.status` metrics will be exported.", - "default": false + "extract": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "aws", + "b3", + "datadog", + "gcp", + "instana", + "jaeger", + "ot", + "w3c" + ] + }, + "description": "Header formats used to extract tracing context from incoming requests. If multiple values are specified, the first one found will be used for extraction. If left empty, Kong will not extract any tracing context information from incoming requests and generate a trace with no parent and a new trace ID." }, - "enable_ai_metrics": { - "type": "boolean", - "description": "A boolean value that determines if AI metrics should be collected. If enabled, `gen_ai.*`, `mcp.*`, `kong.gen_ai.*`, `kong.gen_ai.a2a.*` and `kong.mcp.*` metrics will be exported. To enable latency metrics for AI metrics, `enable_latency_metrics` must also be set to `true`. To enable `error.type` attribute for AI metrics, `enable_request_metrics` must also be set to `true`.", - "default": false + "clear": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Header names to clear after context extraction. This allows to extract the context from a certain header and then remove it from the request, useful when extraction and injection are performed on different header formats and the original header should not be sent to the upstream. If left empty, no headers are cleared." } + }, + "default": { + "default_format": "w3c" } }, - "batch_flush_delay": { + "batch_span_count": { "type": "integer", - "description": "The delay, in seconds, between two consecutive batches." + "description": "The number of spans to be sent in a single batch." }, - "send_timeout": { + "connect_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 5000 + "default": 1000 }, - "logs_endpoint": { + "http_response_header_for_traceid": { + "type": "string" + }, + "sampling_strategy": { "type": "string", - "description": "An HTTP URL endpoint where internal logs are exported.", + "enum": [ + "parent_drop_probability_fallback", + "parent_probability_fallback" + ], + "description": "The sampling strategy to use for OTLP `traces`. Set `parent_drop_probability_fallback` if you want parent-based sampling when the parent span contains a `false` sampled flag, and fallback to probability-based sampling otherwise. Set `parent_probability_fallback` if you want parent-based sampling when the parent span contains a valid sampled flag (`true` or `false`), and fallback to probability-based sampling otherwise.", + "default": "parent_drop_probability_fallback" + }, + "client_certificate": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "Certificate to use as the mTLS client certificate when connecting to a configured HTTPS endpoint. It applies to every signal: traces, logs, access_logs and metrics.", + "x-foreign": true + }, + "traces_endpoint": { + "type": "string", + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search.", "x-referenceable": true }, "access_logs": { @@ -113,34 +158,9 @@ } } }, - "resource_attributes": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-lua-required": true - } - }, "queue": { "type": "object", "properties": { - "max_coalescing_delay": { - "type": "number", - "maximum": 3600, - "minimum": 0, - "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.", - "default": 1 - }, - "max_entries": { - "type": "integer", - "maximum": 1000000, - "minimum": 1, - "description": "Maximum number of entries that can be waiting on the queue.", - "default": 10000 - }, - "max_bytes": { - "type": "integer", - "description": "Maximum number of bytes that can be waiting on a queue, requires string content." - }, "max_retry_time": { "type": "number", "description": "Time in seconds before the queue gives up calling a failed handler for a batch.", @@ -175,6 +195,24 @@ "minimum": 1, "description": "Maximum number of entries that can be processed at a time.", "default": 200 + }, + "max_coalescing_delay": { + "type": "number", + "maximum": 3600, + "minimum": 0, + "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.", + "default": 1 + }, + "max_entries": { + "type": "integer", + "maximum": 1000000, + "minimum": 1, + "description": "Maximum number of entries that can be waiting on the queue.", + "default": 10000 + }, + "max_bytes": { + "type": "integer", + "description": "Maximum number of bytes that can be waiting on a queue, requires string content." } }, "default": { @@ -188,43 +226,6 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 5000 }, - "http_response_header_for_traceid": { - "type": "string" - }, - "sampling_rate": { - "type": "number", - "maximum": 1, - "minimum": 0, - "description": "Tracing sampling rate for configuring the probability-based sampler. When set, this value supersedes the global `tracing_sampling_rate` setting from kong.conf." - }, - "headers": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "The custom headers to be added in the HTTP request sent to the OTLP server. This setting is useful for adding the authentication headers (token) for the APM backend." - }, - "batch_span_count": { - "type": "integer", - "description": "The number of spans to be sent in a single batch." - }, - "client_certificate": { - "type": "object", - "properties": { - "id": { - "type": "string" - } - }, - "description": "Certificate to use as the mTLS client certificate when connecting to a configured HTTPS endpoint. It applies to every signal: traces, logs, access_logs and metrics.", - "x-foreign": true - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 1000 - }, "header_type": { "type": "string", "enum": [ @@ -242,84 +243,88 @@ ], "default": "preserve" }, - "propagation": { + "metrics": { "type": "object", "properties": { - "extract": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "aws", - "b3", - "datadog", - "gcp", - "instana", - "jaeger", - "ot", - "w3c" - ] - }, - "description": "Header formats used to extract tracing context from incoming requests. If multiple values are specified, the first one found will be used for extraction. If left empty, Kong will not extract any tracing context information from incoming requests and generate a trace with no parent and a new trace ID." - }, - "clear": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Header names to clear after context extraction. This allows to extract the context from a certain header and then remove it from the request, useful when extraction and injection are performed on different header formats and the original header should not be sent to the upstream. If left empty, no headers are cleared." + "enable_request_metrics": { + "type": "boolean", + "description": "A boolean value that determines if request count metrics should be collected. If enabled, `http.server.request.count` metrics will be exported.", + "default": false }, - "inject": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "aws", - "b3", - "b3-single", - "datadog", - "gcp", - "instana", - "jaeger", - "ot", - "preserve", - "w3c" - ] - }, - "description": "Header formats used to inject tracing context. The value `preserve` will use the same header format as the incoming request. If multiple values are specified, all of them will be used during injection. If left empty, Kong will not inject any tracing context information in outgoing requests." + "enable_bandwidth_metrics": { + "type": "boolean", + "description": "A boolean value that determines if bandwidth metrics should be collected. If enabled, `http.server.request.size` and `http.server.response.size` metrics will be exported.", + "default": false }, - "default_format": { + "endpoint": { "type": "string", - "enum": [ - "aws", - "b3", - "b3-single", - "datadog", - "gcp", - "instana", - "jaeger", - "ot", - "w3c" - ], - "description": "The default header format to use when extractors did not match any format in the incoming headers and `inject` is configured with the value: `preserve`. This can happen when no tracing header was found in the request, or the incoming tracing header formats were not included in `extract`.", - "default": "w3c" + "description": "An HTTP URL endpoint where metrics are exported.", + "x-referenceable": true + }, + "push_interval": { + "type": "number", + "description": "The interval in seconds at which metrics are pushed to the OTLP server. This setting is only applicable when `endpoint` is set.", + "default": 60 + }, + "enable_consumer_attribute": { + "type": "boolean", + "description": "A boolean value that determines if `http.server.request.count`, `http.server.request.size` and `http.server.response.size` metrics should fill in the consumer attribute when available.", + "default": false + }, + "enable_latency_metrics": { + "type": "boolean", + "description": "A boolean value that determines if latency metrics should be collected. If enabled, `kong.latency.total`, `kong.latency.internal` and `kong.latency.upstream` metrics will be exported.", + "default": false + }, + "enable_upstream_health_metrics": { + "type": "boolean", + "description": "A boolean value that determines if upstream health metrics should be collected. If enabled, `kong.upstream.target.status` metrics will be exported.", + "default": false + }, + "enable_ai_metrics": { + "type": "boolean", + "description": "A boolean value that determines if AI metrics should be collected. If enabled, `gen_ai.*`, `mcp.*`, `kong.gen_ai.*`, `kong.gen_ai.a2a.*` and `kong.mcp.*` metrics will be exported. To enable latency metrics for AI metrics, `enable_latency_metrics` must also be set to `true`. To enable `error.type` attribute for AI metrics, `enable_request_metrics` must also be set to `true`.", + "default": false + }, + "enable_principal_attribute": { + "type": "boolean", + "description": "A boolean value that determines if `http.server.request.count`, `http.server.request.size` and `http.server.response.size` metrics should fill in the principal attributes when an authenticated principal is available.", + "default": false } - }, - "default": { - "default_format": "w3c" } }, - "sampling_strategy": { - "type": "string", - "enum": [ - "parent_drop_probability_fallback", - "parent_probability_fallback" - ], - "description": "The sampling strategy to use for OTLP `traces`. Set `parent_drop_probability_fallback` if you want parent-based sampling when the parent span contains a `false` sampled flag, and fallback to probability-based sampling otherwise. Set `parent_probability_fallback` if you want parent-based sampling when the parent span contains a valid sampled flag (`true` or `false`), and fallback to probability-based sampling otherwise.", - "default": "parent_drop_probability_fallback" + "batch_flush_delay": { + "type": "integer", + "description": "The delay, in seconds, between two consecutive batches." } } }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "tcp", + "tls", + "tls_passthrough", + "udp", + "ws", + "wss" + ], + "description": "A string representing a protocol, such as HTTP or HTTPS." + }, + "description": "A set of strings representing protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "consumer": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/PostFunction.json b/app/_schemas/ai-gateway/policies/PostFunction.json index d90250b260f..288c2ea680a 100644 --- a/app/_schemas/ai-gateway/policies/PostFunction.json +++ b/app/_schemas/ai-gateway/policies/PostFunction.json @@ -29,49 +29,49 @@ "config": { "type": "object", "properties": { - "ws_upstream_frame": { + "rewrite": { "type": "array", "items": { "type": "string" }, "default": [] }, - "certificate": { + "body_filter": { "type": "array", "items": { "type": "string" }, "default": [] }, - "rewrite": { + "log": { "type": "array", "items": { "type": "string" }, "default": [] }, - "access": { + "ws_handshake": { "type": "array", "items": { "type": "string" }, "default": [] }, - "ws_handshake": { + "ws_client_frame": { "type": "array", "items": { "type": "string" }, "default": [] }, - "ws_client_frame": { + "certificate": { "type": "array", "items": { "type": "string" }, "default": [] }, - "ws_close": { + "access": { "type": "array", "items": { "type": "string" @@ -85,14 +85,14 @@ }, "default": [] }, - "body_filter": { + "ws_upstream_frame": { "type": "array", "items": { "type": "string" }, "default": [] }, - "log": { + "ws_close": { "type": "array", "items": { "type": "string" @@ -101,7 +101,7 @@ } } }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -109,9 +109,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -119,7 +119,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/PreFunction.json b/app/_schemas/ai-gateway/policies/PreFunction.json index 595bd10485e..6329813582f 100644 --- a/app/_schemas/ai-gateway/policies/PreFunction.json +++ b/app/_schemas/ai-gateway/policies/PreFunction.json @@ -29,56 +29,56 @@ "config": { "type": "object", "properties": { - "header_filter": { + "certificate": { "type": "array", "items": { "type": "string" }, "default": [] }, - "body_filter": { + "rewrite": { "type": "array", "items": { "type": "string" }, "default": [] }, - "ws_close": { + "header_filter": { "type": "array", "items": { "type": "string" }, "default": [] }, - "certificate": { + "body_filter": { "type": "array", "items": { "type": "string" }, "default": [] }, - "rewrite": { + "ws_handshake": { "type": "array", "items": { "type": "string" }, "default": [] }, - "log": { + "ws_client_frame": { "type": "array", "items": { "type": "string" }, "default": [] }, - "ws_handshake": { + "access": { "type": "array", "items": { "type": "string" }, "default": [] }, - "ws_client_frame": { + "log": { "type": "array", "items": { "type": "string" @@ -92,7 +92,7 @@ }, "default": [] }, - "access": { + "ws_close": { "type": "array", "items": { "type": "string" diff --git a/app/_schemas/ai-gateway/policies/Prometheus.json b/app/_schemas/ai-gateway/policies/Prometheus.json index bc85e122837..6268aa1811f 100644 --- a/app/_schemas/ai-gateway/policies/Prometheus.json +++ b/app/_schemas/ai-gateway/policies/Prometheus.json @@ -29,6 +29,11 @@ "config": { "type": "object", "properties": { + "per_consumer": { + "type": "boolean", + "description": "A boolean value that determines if per-consumer metrics should be collected. If enabled, the `kong_http_requests_total` and `kong_bandwidth_bytes` metrics fill in the consumer label when available.", + "default": false + }, "status_code_metrics": { "type": "boolean", "description": "A boolean value that determines if status code metrics should be collected. If enabled, `http_requests_total`, `stream_sessions_total` metrics will be exported.", @@ -56,15 +61,10 @@ }, "wasm_metrics": { "type": "boolean" - }, - "per_consumer": { - "type": "boolean", - "description": "A boolean value that determines if per-consumer metrics should be collected. If enabled, the `kong_http_requests_total` and `kong_bandwidth_bytes` metrics fill in the consumer label when available.", - "default": false } } }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -72,9 +72,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -82,9 +82,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -92,7 +92,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/ProxyCache.json b/app/_schemas/ai-gateway/policies/ProxyCache.json index 0d26f2fd144..74f12afe3e1 100644 --- a/app/_schemas/ai-gateway/policies/ProxyCache.json +++ b/app/_schemas/ai-gateway/policies/ProxyCache.json @@ -29,6 +29,28 @@ "config": { "type": "object", "properties": { + "memory": { + "type": "object", + "properties": { + "dictionary_name": { + "type": "string", + "description": "The name of the shared dictionary in which to hold cache entities when the memory strategy is selected. Note that this dictionary currently must be defined manually in the Kong Nginx template.", + "default": "kong_db_cache" + } + } + }, + "cache_ttl": { + "type": "integer", + "description": "TTL, in seconds, of cache entities.", + "default": 300 + }, + "strategy": { + "type": "string", + "enum": [ + "memory" + ], + "description": "The backing data store in which to hold cache entities." + }, "cache_control": { "type": "boolean", "description": "When enabled, respect the Cache-Control behaviors defined in RFC7234.", @@ -42,31 +64,6 @@ "type": "integer", "description": "Number of seconds to keep resources in the storage backend. This value is independent of `cache_ttl` or resource TTLs defined by Cache-Control behaviors." }, - "memory": { - "type": "object", - "properties": { - "dictionary_name": { - "type": "string", - "description": "The name of the shared dictionary in which to hold cache entities when the memory strategy is selected. Note that this dictionary currently must be defined manually in the Kong Nginx template.", - "default": "kong_db_cache" - } - } - }, - "response_code": { - "type": "array", - "items": { - "type": "integer", - "maximum": 900, - "minimum": 100 - }, - "minLength": 1, - "description": "Upstream response status code considered cacheable.", - "default": [ - 200, - 301, - 404 - ] - }, "vary_query_params": { "type": "array", "items": { @@ -84,21 +81,36 @@ "response_headers": { "type": "object", "properties": { - "age": { + "X-Cache-Status": { "type": "boolean", "default": true }, - "X-Cache-Status": { + "X-Cache-Key": { "type": "boolean", "default": true }, - "X-Cache-Key": { + "age": { "type": "boolean", "default": true } }, "description": "Caching related diagnostic headers that should be included in cached responses" }, + "response_code": { + "type": "array", + "items": { + "type": "integer", + "maximum": 900, + "minimum": 100 + }, + "minLength": 1, + "description": "Upstream response status code considered cacheable.", + "default": [ + 200, + 301, + 404 + ] + }, "request_method": { "type": "array", "items": { @@ -127,25 +139,13 @@ "application/json", "text/plain" ] - }, - "cache_ttl": { - "type": "integer", - "description": "TTL, in seconds, of cache entities.", - "default": 300 - }, - "strategy": { - "type": "string", - "enum": [ - "memory" - ], - "description": "The backing data store in which to hold cache entities." } }, "required": [ "strategy" ] }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -153,9 +153,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer_group": { + "service": { "type": "object", "properties": { "id": { @@ -163,9 +163,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -173,9 +173,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -183,7 +183,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/ProxyCacheAdvanced.json b/app/_schemas/ai-gateway/policies/ProxyCacheAdvanced.json index 4a20d6b254a..4a98f96cfac 100644 --- a/app/_schemas/ai-gateway/policies/ProxyCacheAdvanced.json +++ b/app/_schemas/ai-gateway/policies/ProxyCacheAdvanced.json @@ -37,28 +37,13 @@ 404 ] }, - "request_method": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "GET", - "HEAD", - "PATCH", - "POST", - "PUT" - ] - }, - "description": "Downstream request methods considered cacheable. Available options: `HEAD`, `GET`, `POST`, `PATCH`, `PUT`.", - "default": [ - "GET", - "HEAD" - ] - }, - "cache_ttl": { - "type": "integer", - "description": "TTL in seconds of cache entities.", - "default": 300 + "strategy": { + "type": "string", + "enum": [ + "memory", + "redis" + ], + "description": "The backing data store in which to hold cache entities. Accepted values are: `memory` and `redis`." }, "cache_control": { "type": "boolean", @@ -82,36 +67,85 @@ }, "description": "Relevant query parameters considered for the cache key. If undefined, all params are taken into consideration. By default, the max number of params accepted is 100. You can change this value via the `lua_max_post_args` in `kong.conf`." }, + "vary_headers": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Relevant headers considered for the cache key. If undefined, none of the headers are taken into consideration." + }, + "response_headers": { + "type": "object", + "properties": { + "age": { + "type": "boolean", + "default": true + }, + "X-Cache-Status": { + "type": "boolean", + "default": true + }, + "X-Cache-Key": { + "type": "boolean", + "default": true + } + }, + "description": "Caching related diagnostic headers that should be included in cached responses" + }, "redis": { "type": "object", "properties": { + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, "cluster_max_redirections": { "type": "integer", "description": "Maximum retry attempts for redirection.", "default": 5 }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "send_timeout": { + "connect_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, "sentinel_password": { "type": "string", "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", @@ -121,6 +155,17 @@ "cloud_authentication": { "type": "object", "properties": { + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true + }, + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, "aws_region": { "type": "string", "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", @@ -131,66 +176,55 @@ "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", "default": true }, - "aws_role_session_name": { + "aws_access_key_id": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "gcp_service_account_json": { + "aws_secret_access_key": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true - }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, - "aws_access_key_id": { + "gcp_service_account_json": { "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", "x-referenceable": true, "x-encrypted": true }, - "aws_secret_access_key": { + "azure_client_secret": { "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_assume_role_arn": { + "azure_tenant_id": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_id": { + "auth_provider": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true }, - "azure_client_secret": { + "aws_assume_role_arn": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, - "azure_tenant_id": { + "aws_role_session_name": { "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true } @@ -202,11 +236,31 @@ "description": "Database to use for the Redis connection when using the `redis` strategy", "default": 0 }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, "ssl": { "type": "boolean", "description": "If set to true, uses SSL to connect to Redis.", "default": false }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, "read_timeout": { "type": "integer", "maximum": 2147483646, @@ -214,60 +268,55 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, "sentinel_nodes": { "type": "array", "items": { "type": "object", "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, "port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 6379 - } - } - }, - "minLength": 1, - "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." - }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { + }, + "host": { "type": "string", "description": "A string representing a host name, such as example.com.", "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 } } }, "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "server_name": { + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "sentinel_master": { "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, "host": { "type": "string", @@ -275,58 +324,32 @@ "default": "127.0.0.1", "x-referenceable": true }, - "connect_timeout": { + "send_timeout": { "type": "integer", "maximum": 2147483646, "minimum": 0, "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-encrypted": true, - "x-referenceable": true - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true } } }, - "bypass_on_err": { - "type": "boolean", - "description": "Unhandled errors while trying to retrieve a cache entry (such as redis down) are resolved with `Bypass`, with the request going upstream.", - "default": false + "request_method": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "GET", + "HEAD", + "PATCH", + "POST", + "PUT" + ] + }, + "description": "Downstream request methods considered cacheable. Available options: `HEAD`, `GET`, `POST`, `PATCH`, `PUT`.", + "default": [ + "GET", + "HEAD" + ] }, "content_type": { "type": "array", @@ -339,13 +362,10 @@ "text/plain" ] }, - "strategy": { - "type": "string", - "enum": [ - "memory", - "redis" - ], - "description": "The backing data store in which to hold cache entities. Accepted values are: `memory` and `redis`." + "cache_ttl": { + "type": "integer", + "description": "TTL in seconds of cache entities.", + "default": 300 }, "ignore_uri_case": { "type": "boolean", @@ -356,30 +376,10 @@ "type": "integer", "description": "Number of seconds to keep resources in the storage backend. This value is independent of `cache_ttl` or resource TTLs defined by Cache-Control behaviors." }, - "vary_headers": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Relevant headers considered for the cache key. If undefined, none of the headers are taken into consideration." - }, - "response_headers": { - "type": "object", - "properties": { - "age": { - "type": "boolean", - "default": true - }, - "X-Cache-Status": { - "type": "boolean", - "default": true - }, - "X-Cache-Key": { - "type": "boolean", - "default": true - } - }, - "description": "Caching related diagnostic headers that should be included in cached responses" + "bypass_on_err": { + "type": "boolean", + "description": "Unhandled errors while trying to retrieve a cache entry (such as redis down) are resolved with `Bypass`, with the request going upstream.", + "default": false } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/RateLimiting.json b/app/_schemas/ai-gateway/policies/RateLimiting.json index 7f17f6a1a56..3fb81637fb5 100644 --- a/app/_schemas/ai-gateway/policies/RateLimiting.json +++ b/app/_schemas/ai-gateway/policies/RateLimiting.json @@ -22,10 +22,24 @@ "config": { "type": "object", "properties": { - "sync_rate": { + "policy": { + "type": "string", + "enum": [ + "cluster", + "local", + "redis" + ], + "description": "The rate-limiting policies to use for retrieving and incrementing the limits.", + "default": "local" + }, + "fault_tolerant": { + "type": "boolean", + "description": "A boolean value that determines if the requests should be proxied even if Kong has troubles connecting a third-party data store. If `true`, requests will be proxied anyway, effectively disabling the rate-limiting function until the data store is working again. If `false`, then the clients will see `500` errors.", + "default": true + }, + "second": { "type": "number", - "description": "How often to sync counter data to the central data store. A value of -1 results in synchronous behavior.", - "default": -1 + "description": "The number of HTTP requests that can be made per second." }, "minute": { "type": "number", @@ -39,20 +53,23 @@ "type": "number", "description": "The number of HTTP requests that can be made per month." }, - "header_name": { - "type": "string", - "description": "A string representing an HTTP header name." + "hide_client_headers": { + "type": "boolean", + "description": "Optionally hide informative response headers.", + "default": false + }, + "error_code": { + "type": "number", + "description": "Set a custom error code to return when the rate limit is exceeded.", + "default": 429 + }, + "day": { + "type": "number", + "description": "The number of HTTP requests that can be made per day." }, "redis": { "type": "object", "properties": { - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, "username": { "type": "string", "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", @@ -61,6 +78,18 @@ "cloud_authentication": { "type": "object", "properties": { + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, "auth_provider": { "type": "string", "enum": [ @@ -76,67 +105,61 @@ "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_region": { - "type": "string", - "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, "aws_is_serverless": { "type": "boolean", "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", "default": true }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_assume_role_arn": { + "aws_access_key_id": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "gcp_service_account_json": { + "aws_secret_access_key": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-encrypted": true, "x-referenceable": true }, - "azure_client_secret": { + "aws_assume_role_arn": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, - "aws_access_key_id": { + "azure_client_id": { "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "azure_client_secret": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_id": { + "aws_region": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true }, - "azure_tenant_id": { + "aws_role_session_name": { "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-encrypted": true, + "x-referenceable": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, "database": { "type": "integer", "description": "Database to use for the Redis connection when using the `redis` strategy", @@ -170,23 +193,29 @@ "default": 6379, "x-referenceable": true }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-encrypted": true, - "x-referenceable": true + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 } }, "description": "Redis configuration" }, - "hide_client_headers": { - "type": "boolean", - "description": "Optionally hide informative response headers.", - "default": false + "error_message": { + "type": "string", + "description": "Set a custom error message to return when the rate limit is exceeded.", + "default": "API rate limit exceeded" }, - "second": { + "sync_rate": { "type": "number", - "description": "The number of HTTP requests that can be made per second." + "description": "How often to sync counter data to the central data store. A value of -1 results in synchronous behavior.", + "default": -1 + }, + "year": { + "type": "number", + "description": "The number of HTTP requests that can be made per year." }, "limit_by": { "type": "string", @@ -202,46 +231,17 @@ "description": "The entity that is used when aggregating the limits.", "default": "consumer" }, - "path": { - "type": "string", - "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." - }, - "year": { - "type": "number", - "description": "The number of HTTP requests that can be made per year." - }, - "error_code": { - "type": "number", - "description": "Set a custom error code to return when the rate limit is exceeded.", - "default": 429 - }, - "day": { - "type": "number", - "description": "The number of HTTP requests that can be made per day." - }, - "policy": { + "header_name": { "type": "string", - "enum": [ - "cluster", - "local", - "redis" - ], - "description": "The rate-limiting policies to use for retrieving and incrementing the limits.", - "default": "local" - }, - "fault_tolerant": { - "type": "boolean", - "description": "A boolean value that determines if the requests should be proxied even if Kong has troubles connecting a third-party data store. If `true`, requests will be proxied anyway, effectively disabling the rate-limiting function until the data store is working again. If `false`, then the clients will see `500` errors.", - "default": true + "description": "A string representing an HTTP header name." }, - "error_message": { + "path": { "type": "string", - "description": "Set a custom error message to return when the rate limit is exceeded.", - "default": "API rate limit exceeded" + "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." } } }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -249,9 +249,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -259,9 +259,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -269,9 +269,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -279,7 +279,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "x-supported-partials": [ diff --git a/app/_schemas/ai-gateway/policies/RateLimitingAdvanced.json b/app/_schemas/ai-gateway/policies/RateLimitingAdvanced.json index 34edcf7bab7..1c2143ecaa5 100644 --- a/app/_schemas/ai-gateway/policies/RateLimitingAdvanced.json +++ b/app/_schemas/ai-gateway/policies/RateLimitingAdvanced.json @@ -22,13 +22,30 @@ "config": { "type": "object", "properties": { - "header_name": { + "error_code": { + "type": "number", + "description": "Set a custom error code to return when the rate limit is exceeded.", + "default": 429 + }, + "error_message": { "type": "string", - "description": "A string representing an HTTP header name." + "description": "Set a custom error message to return when the rate limit is exceeded.", + "default": "API rate limit exceeded" }, - "path": { + "identifier": { "type": "string", - "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." + "enum": [ + "consumer", + "consumer-group", + "credential", + "header", + "ip", + "path", + "route", + "service" + ], + "description": "The type of identifier used to generate the rate limit key. Defines the scope used to increment the rate limiting counters. Note if `identifier` is `consumer-group`, the policy must be applied on a consumer group entity. Because a consumer may belong to multiple consumer groups, the policy needs to know explicitly which consumer group to limit the rate.", + "default": "consumer" }, "window_size": { "type": "array", @@ -37,9 +54,20 @@ }, "description": "One or more window sizes to apply a limit to (defined in seconds). There must be a matching number of window limits and sizes specified." }, - "sync_rate": { - "type": "number", - "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms)." + "header_name": { + "type": "string", + "description": "A string representing an HTTP header name." + }, + "consumer_groups": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of consumer groups allowed to override the rate limiting settings for the given Route or Service. Required if `enforce_consumer_groups` is set to `true`." + }, + "namespace": { + "type": "string", + "description": "Specifies the rate-limiting namespace for this policy instance. A namespace acts as a logical grouping for configuration and counter data used by the rate-limiting algorithm. Namespaces define how and where counter data is stored and synchronized. When multiple policy instances share the same namespace, they also share the same rate-limiting counters and synchronization configuration. Conversely, using different namespaces ensures that each policy instance maintains its own independent counters." }, "strategy": { "type": "string", @@ -51,14 +79,82 @@ "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local`, `redis` and `cluster`.", "default": "local" }, - "redis": { + "retry_after_jitter_max": { + "type": "number", + "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.", + "default": 0 + }, + "throttling": { "type": "object", "properties": { - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", + "enabled": { + "type": "boolean", + "description": "Determines if the throttling feature is enabled or not", + "default": false + }, + "interval": { + "type": "number", + "maximum": 1000000, + "minimum": 1, + "description": "The period between two successive retries for an individual request (in seconds)", "default": 5 }, + "retry_times": { + "type": "number", + "maximum": 1000000, + "minimum": 1, + "description": "The maximum number of retries for an individual request", + "default": 3 + }, + "queue_limit": { + "type": "number", + "maximum": 1000000, + "minimum": 1, + "description": "The maximum number of requests allowed for throttling", + "default": 5 + } + } + }, + "disable_penalty": { + "type": "boolean", + "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type.", + "default": false + }, + "window_type": { + "type": "string", + "enum": [ + "fixed", + "sliding" + ], + "description": "Sets the time window type to either `sliding` (default) or `fixed`. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window's counters.", + "default": "sliding" + }, + "sync_rate": { + "type": "number", + "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms)." + }, + "dictionary_name": { + "type": "string", + "description": "The shared dictionary where counters are stored. When the policy is configured to synchronize counter data externally (that is `config.strategy` is `cluster` or `redis` and `config.sync_rate` isn't `-1`), this dictionary serves as a buffer to populate counters in the data store on each synchronization cycle.", + "default": "kong_rate_limiting_counters" + }, + "lock_dictionary_name": { + "type": "string", + "description": "The shared dictionary where concurrency control locks are stored. The default shared dictionary is `kong_locks`. The shared dictionary should be declare in nginx-kong.conf.", + "default": "kong_locks" + }, + "hide_client_headers": { + "type": "boolean", + "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.", + "default": false + }, + "path": { + "type": "string", + "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." + }, + "redis": { + "type": "object", + "properties": { "host": { "type": "string", "description": "A string representing a host name, such as example.com.", @@ -72,84 +168,23 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, - "redis_proxy_type": { - "type": "string", - "enum": [ - "envoy_v1.31" - ], - "description": "If the `connection_is_proxied` is enabled, this field indicates the proxy type and version you are using. For example, you can enable this optioin when you want authentication between Kong and Envoy proxy." - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-encrypted": true, - "x-referenceable": true - }, "sentinel_username": { "type": "string", "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true - }, "cloud_authentication": { "type": "object", "properties": { - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_secret_access_key": { - "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-encrypted": true, - "x-referenceable": true - }, - "aws_assume_role_arn": { + "azure_client_secret": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "azure_tenant_id": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, @@ -158,11 +193,16 @@ "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "gcp_service_account_json": { + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_access_key_id": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-encrypted": true, + "x-referenceable": true }, "azure_client_id": { "type": "string", @@ -170,18 +210,6 @@ "x-referenceable": true, "x-encrypted": true }, - "azure_client_secret": { - "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, "auth_provider": { "type": "string", "enum": [ @@ -197,14 +225,49 @@ "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-encrypted": true, + "x-referenceable": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-encrypted": true, + "x-referenceable": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, "sentinel_nodes": { "type": "array", "items": { @@ -249,11 +312,6 @@ "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, "port": { "type": "integer", "maximum": 65535, @@ -262,6 +320,21 @@ "default": 6379, "x-referenceable": true }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, "send_timeout": { "type": "integer", "maximum": 2147483646, @@ -281,123 +354,57 @@ "description": "Database to use for the Redis connection when using the `redis` strategy", "default": 0 }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, "server_name": { "type": "string", "description": "A string representing an SNI (server name indication) value for TLS.", "x-referenceable": true - } - } - }, - "throttling": { - "type": "object", - "properties": { - "enabled": { + }, + "connection_is_proxied": { "type": "boolean", - "description": "Determines if the throttling feature is enabled or not", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", "default": false }, - "interval": { - "type": "number", - "maximum": 1000000, - "minimum": 1, - "description": "The period between two successive retries for an individual request (in seconds)", - "default": 5 + "redis_proxy_type": { + "type": "string", + "enum": [ + "envoy_v1.31" + ], + "description": "If the `connection_is_proxied` is enabled, this field indicates the proxy type and version you are using. For example, you can enable this optioin when you want authentication between Kong and Envoy proxy." }, - "retry_times": { - "type": "number", - "maximum": 1000000, - "minimum": 1, - "description": "The maximum number of retries for an individual request", - "default": 3 + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true }, - "queue_limit": { - "type": "number", - "maximum": 1000000, - "minimum": 1, - "description": "The maximum number of requests allowed for throttling", + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-encrypted": true, + "x-referenceable": true + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", "default": 5 } } }, - "limit": { - "type": "array", - "items": { - "type": "number" - }, - "description": "One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified." - }, - "lock_dictionary_name": { - "type": "string", - "description": "The shared dictionary where concurrency control locks are stored. The default shared dictionary is `kong_locks`. The shared dictionary should be declare in nginx-kong.conf.", - "default": "kong_locks" - }, - "consumer_groups": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of consumer groups allowed to override the rate limiting settings for the given Route or Service. Required if `enforce_consumer_groups` is set to `true`." - }, - "disable_penalty": { - "type": "boolean", - "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type.", - "default": false - }, - "identifier": { - "type": "string", - "enum": [ - "consumer", - "consumer-group", - "credential", - "header", - "ip", - "path", - "route", - "service" - ], - "description": "The type of identifier used to generate the rate limit key. Defines the scope used to increment the rate limiting counters. Note if `identifier` is `consumer-group`, the policy must be applied on a consumer group entity. Because a consumer may belong to multiple consumer groups, the policy needs to know explicitly which consumer group to limit the rate.", - "default": "consumer" - }, - "window_type": { - "type": "string", - "enum": [ - "fixed", - "sliding" - ], - "description": "Sets the time window type to either `sliding` (default) or `fixed`. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window's counters.", - "default": "sliding" - }, - "dictionary_name": { - "type": "string", - "description": "The shared dictionary where counters are stored. When the policy is configured to synchronize counter data externally (that is `config.strategy` is `cluster` or `redis` and `config.sync_rate` isn't `-1`), this dictionary serves as a buffer to populate counters in the data store on each synchronization cycle.", - "default": "kong_rate_limiting_counters" - }, - "hide_client_headers": { + "enforce_consumer_groups": { "type": "boolean", - "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.", + "description": "Determines if consumer groups are allowed to override the rate limiting settings for the given Route or Service. Flipping `enforce_consumer_groups` from `true` to `false` disables the group override, but does not clear the list of consumer groups. You can then flip `enforce_consumer_groups` to `true` to re-enforce the groups.", "default": false }, - "retry_after_jitter_max": { - "type": "number", - "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.", - "default": 0 - }, - "error_code": { - "type": "number", - "description": "Set a custom error code to return when the rate limit is exceeded.", - "default": 429 - }, "compound_identifier": { "type": "array", "items": { @@ -415,19 +422,12 @@ }, "description": "Similar to `identifer`, but supports combining multiple items. The priority of `compound_identifier` is higher than `identifier`, which means if `compound_identifer` is set, it will be used, otherwise `identifier` will be used." }, - "namespace": { - "type": "string", - "description": "Specifies the rate-limiting namespace for this policy instance. A namespace acts as a logical grouping for configuration and counter data used by the rate-limiting algorithm. Namespaces define how and where counter data is stored and synchronized. When multiple policy instances share the same namespace, they also share the same rate-limiting counters and synchronization configuration. Conversely, using different namespaces ensures that each policy instance maintains its own independent counters." - }, - "enforce_consumer_groups": { - "type": "boolean", - "description": "Determines if consumer groups are allowed to override the rate limiting settings for the given Route or Service. Flipping `enforce_consumer_groups` from `true` to `false` disables the group override, but does not clear the list of consumer groups. You can then flip `enforce_consumer_groups` to `true` to re-enforce the groups.", - "default": false - }, - "error_message": { - "type": "string", - "description": "Set a custom error message to return when the rate limit is exceeded.", - "default": "API rate limit exceeded" + "limit": { + "type": "array", + "items": { + "type": "number" + }, + "description": "One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified." } }, "required": [ @@ -435,7 +435,7 @@ "window_size" ] }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -443,9 +443,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -453,9 +453,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -463,9 +463,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -473,7 +473,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/Redirect.json b/app/_schemas/ai-gateway/policies/Redirect.json index bd0b2f05e0a..e9e7cd2d851 100644 --- a/app/_schemas/ai-gateway/policies/Redirect.json +++ b/app/_schemas/ai-gateway/policies/Redirect.json @@ -43,7 +43,7 @@ "location" ] }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -51,9 +51,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -61,9 +61,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -71,9 +71,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -81,7 +81,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/RequestCallout.json b/app/_schemas/ai-gateway/policies/RequestCallout.json index 12fd86d3737..0e7235d0f15 100644 --- a/app/_schemas/ai-gateway/policies/RequestCallout.json +++ b/app/_schemas/ai-gateway/policies/RequestCallout.json @@ -27,33 +27,29 @@ "items": { "type": "object", "properties": { - "name": { - "type": "string", - "description": "A string identifier for a callout. A callout object is referenceable via its name in the `kong.ctx.shared.callouts.`" - }, - "depends_on": { - "type": "array", - "items": { - "type": "string" - }, - "description": "An array of callout names the current callout depends on. This dependency list determines the callout execution order via a topological sorting algorithm.", - "default": [] - }, "request": { "type": "object", "properties": { + "method": { + "type": "string", + "description": "The HTTP method that will be requested.", + "default": "GET" + }, "http_opts": { "type": "object", "properties": { + "ssl_verify": { + "type": "boolean", + "description": "If set to `true`, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your callout API. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "ssl_server_name": { + "type": "string", + "description": "The SNI used in the callout request. Defaults to host if omitted." + }, "timeouts": { "type": "object", "properties": { - "write": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "The socket write timeout." - }, "read": { "type": "integer", "maximum": 2147483646, @@ -65,6 +61,12 @@ "maximum": 2147483646, "minimum": 0, "description": "The socket connect timeout." + }, + "write": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "The socket write timeout." } }, "description": "Socket timeouts in milliseconds. All or none must be set." @@ -72,6 +74,11 @@ "proxy": { "type": "object", "properties": { + "auth_username": { + "type": "string", + "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", + "x-referenceable": true + }, "auth_password": { "type": "string", "description": "The password to authenticate with, if the forward proxy is protected by basic authentication.", @@ -85,23 +92,9 @@ "http_proxy": { "type": "string", "description": "The HTTP proxy URL. This proxy server will be used for HTTP requests." - }, - "auth_username": { - "type": "string", - "description": "The username to authenticate with, if the forward proxy is protected by basic authentication.", - "x-referenceable": true } }, "description": "Proxy settings." - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to `true`, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your callout API. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "ssl_server_name": { - "type": "string", - "description": "The SNI used in the callout request. Defaults to host if omitted." } }, "description": "HTTP connection parameters." @@ -171,6 +164,11 @@ "error": { "type": "object", "properties": { + "retries": { + "type": "integer", + "description": "The number of retries the policy will attempt on TCP and HTTP errors if `on_error` is set to `retry`.", + "default": 2 + }, "http_statuses": { "type": "array", "items": { @@ -198,11 +196,6 @@ "retry" ], "default": "fail" - }, - "retries": { - "type": "integer", - "description": "The number of retries the policy will attempt on TCP and HTTP errors if `on_error` is set to `retry`.", - "default": 2 } }, "description": "The error handling policy the policy will apply to TCP and HTTP errors." @@ -215,11 +208,6 @@ "type": "string", "description": "The URL that will be requested. Values can contain Lua expressions in the form `$(some_lua_expression)`. The syntax is based on `request-transformer-advanced` templates.", "x-referenceable": true - }, - "method": { - "type": "string", - "description": "The HTTP method that will be requested.", - "default": "GET" } }, "required": [ @@ -273,6 +261,18 @@ } }, "description": "Callout caching configuration." + }, + "name": { + "type": "string", + "description": "A string identifier for a callout. A callout object is referenceable via its name in the `kong.ctx.shared.callouts.`" + }, + "depends_on": { + "type": "array", + "items": { + "type": "string" + }, + "description": "An array of callout names the current callout depends on. This dependency list determines the callout execution order via a topological sorting algorithm.", + "default": [] } }, "required": [ @@ -313,25 +313,108 @@ "redis": { "type": "object", "properties": { - "connection_is_proxied": { + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "ssl": { "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "description": "If set to true, uses SSL to connect to Redis.", "default": false }, - "port": { + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_pool_size": { "type": "integer", - "maximum": 65535, + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", "x-referenceable": true }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, "cloud_authentication": { "type": "object", "properties": { - "aws_cache_name": { + "auth_provider": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, "aws_region": { @@ -339,6 +422,11 @@ "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, "aws_access_key_id": { "type": "string", "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", @@ -351,6 +439,12 @@ "x-referenceable": true, "x-encrypted": true }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, "aws_role_session_name": { "type": "string", "description": "The session name for the temporary credentials when assuming the IAM role.", @@ -363,22 +457,16 @@ "x-referenceable": true, "x-encrypted": true }, - "azure_client_id": { + "aws_cache_name": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true }, - "aws_assume_role_arn": { + "azure_client_id": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", - "x-referenceable": true, - "x-encrypted": true + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true }, "azure_client_secret": { "type": "string", @@ -391,20 +479,15 @@ "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true - }, - "auth_provider": { - "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", - "x-referenceable": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, "sentinel_role": { "type": "string", "enum": [ @@ -441,113 +524,30 @@ "items": { "type": "object", "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, "port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 6379 + }, + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" } } }, "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "read_timeout": { + "port": { "type": "integer", - "maximum": 2147483646, + "maximum": 65535, "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, "x-referenceable": true - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true } } } @@ -579,6 +579,14 @@ "body": { "type": "object", "properties": { + "custom": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "The custom body fields to be added in the upstream request body. Values can contain Lua expressions in the form $(some_lua_expression). The syntax is based on `request-transformer-advanced` templates." + }, "forward": { "type": "boolean", "description": "If `false`, skips forwarding the incoming request's body to the upstream request.", @@ -588,14 +596,6 @@ "type": "boolean", "description": "If `true`, decodes the request's body to make it available for upstream by_lua customizations. Only JSON content type is supported.", "default": true - }, - "custom": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "The custom body fields to be added in the upstream request body. Values can contain Lua expressions in the form $(some_lua_expression). The syntax is based on `request-transformer-advanced` templates." } }, "description": "Callout request body customizations." @@ -631,7 +631,7 @@ "callouts" ] }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -639,9 +639,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -649,9 +649,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -659,9 +659,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -669,7 +669,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/RequestSizeLimiting.json b/app/_schemas/ai-gateway/policies/RequestSizeLimiting.json index 10f1b275f97..6aabe073547 100644 --- a/app/_schemas/ai-gateway/policies/RequestSizeLimiting.json +++ b/app/_schemas/ai-gateway/policies/RequestSizeLimiting.json @@ -44,7 +44,7 @@ } } }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -52,9 +52,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -62,9 +62,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -72,7 +72,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/RequestTermination.json b/app/_schemas/ai-gateway/policies/RequestTermination.json index e701078ba96..85abb5c2fd7 100644 --- a/app/_schemas/ai-gateway/policies/RequestTermination.json +++ b/app/_schemas/ai-gateway/policies/RequestTermination.json @@ -1,15 +1,27 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { - "status_code": { - "type": "integer", - "maximum": 599, - "minimum": 100, - "description": "The response code to send. Must be an integer between 100 and 599.", - "default": 503 - }, "message": { "type": "string", "description": "The message to send, if using the default response generator." @@ -30,29 +42,17 @@ "trigger": { "type": "string", "description": "A string representing an HTTP header name." + }, + "status_code": { + "type": "integer", + "maximum": 599, + "minimum": 100, + "description": "The response code to send. Must be an integer between 100 and 599.", + "default": 503 } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -60,9 +60,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -70,9 +70,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -80,9 +80,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -90,7 +90,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/RequestTransformer.json b/app/_schemas/ai-gateway/policies/RequestTransformer.json index 3430e6f7ec4..4432044d940 100644 --- a/app/_schemas/ai-gateway/policies/RequestTransformer.json +++ b/app/_schemas/ai-gateway/policies/RequestTransformer.json @@ -29,7 +29,7 @@ "config": { "type": "object", "properties": { - "replace": { + "rename": { "type": "object", "properties": { "body": { @@ -52,30 +52,30 @@ "type": "string" }, "default": [] - }, - "uri": { - "type": "string" } } }, - "add": { + "replace": { "type": "object", "properties": { - "querystring": { + "headers": { "type": "array", "items": { "type": "string" }, "default": [] }, - "body": { + "querystring": { "type": "array", "items": { "type": "string" }, "default": [] }, - "headers": { + "uri": { + "type": "string" + }, + "body": { "type": "array", "items": { "type": "string" @@ -84,24 +84,24 @@ } } }, - "append": { + "add": { "type": "object", "properties": { - "body": { + "headers": { "type": "array", "items": { "type": "string" }, "default": [] }, - "headers": { + "querystring": { "type": "array", "items": { "type": "string" }, "default": [] }, - "querystring": { + "body": { "type": "array", "items": { "type": "string" @@ -110,11 +110,7 @@ } } }, - "http_method": { - "type": "string", - "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters." - }, - "remove": { + "append": { "type": "object", "properties": { "body": { @@ -140,24 +136,28 @@ } } }, - "rename": { + "http_method": { + "type": "string", + "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters." + }, + "remove": { "type": "object", "properties": { - "headers": { + "body": { "type": "array", "items": { "type": "string" }, "default": [] }, - "querystring": { + "headers": { "type": "array", "items": { "type": "string" }, "default": [] }, - "body": { + "querystring": { "type": "array", "items": { "type": "string" @@ -168,7 +168,7 @@ } } }, - "consumer_group": { + "consumer": { "type": "object", "properties": { "id": { @@ -176,9 +176,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "route": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -186,9 +186,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -196,9 +196,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -206,7 +206,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/RequestTransformerAdvanced.json b/app/_schemas/ai-gateway/policies/RequestTransformerAdvanced.json index 5b66ac5ef4d..da0ac11304a 100644 --- a/app/_schemas/ai-gateway/policies/RequestTransformerAdvanced.json +++ b/app/_schemas/ai-gateway/policies/RequestTransformerAdvanced.json @@ -1,24 +1,27 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { - "max_request_body_size": { - "type": "integer", - "description": "The maximum request body size, in bytes, that the policy reads to apply body transformations. Bodies larger than `client_body_buffer_size` are buffered by Nginx to a temporary file. `-1` (the default) disables reading such buffered bodies, so their body transformations are skipped to avoid the extra disk I/O. `0` means unlimited (still bounded by Nginx's `client_max_body_size`), and any positive value caps how much of the buffered body is read from the temporary file.", - "default": -1 - }, - "allow": { - "type": "object", - "properties": { - "body": { - "type": "array", - "items": { - "type": "string" - } - } - } - }, "http_method": { "type": "string", "description": "A string representing an HTTP method, such as GET, POST, PUT, or DELETE. The string must contain only uppercase letters." @@ -78,7 +81,7 @@ } } }, - "replace": { + "add": { "type": "object", "properties": { "body": { @@ -116,13 +119,10 @@ ] }, "default": [] - }, - "uri": { - "type": "string" } } }, - "add": { + "append": { "type": "object", "properties": { "body": { @@ -163,17 +163,20 @@ } } }, - "append": { + "allow": { "type": "object", "properties": { "body": { "type": "array", "items": { - "type": "string", - "x-referenceable": true - }, - "default": [] - }, + "type": "string" + } + } + } + }, + "replace": { + "type": "object", + "properties": { "headers": { "type": "array", "items": { @@ -201,6 +204,17 @@ ] }, "default": [] + }, + "uri": { + "type": "string" + }, + "body": { + "type": "array", + "items": { + "type": "string", + "x-referenceable": true + }, + "default": [] } } }, @@ -208,29 +222,15 @@ "type": "boolean", "description": "Specify whether dots (for example, `customers.info.phone`) should be treated as part of a property name or used to descend into nested JSON objects.", "default": true + }, + "max_request_body_size": { + "type": "integer", + "description": "The maximum request body size, in bytes, that the policy reads to apply body transformations. Bodies larger than `client_body_buffer_size` are buffered by Nginx to a temporary file. `-1` (the default) disables reading such buffered bodies, so their body transformations are skipped to avoid the extra disk I/O. `0` means unlimited (still bounded by Nginx's `client_max_body_size`), and any positive value caps how much of the buffered body is read from the temporary file.", + "default": -1 } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -238,9 +238,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer_group": { + "service": { "type": "object", "properties": { "id": { @@ -248,9 +248,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -258,9 +258,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -268,7 +268,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/RequestValidator.json b/app/_schemas/ai-gateway/policies/RequestValidator.json index 7617d811eae..cd0a39b310f 100644 --- a/app/_schemas/ai-gateway/policies/RequestValidator.json +++ b/app/_schemas/ai-gateway/policies/RequestValidator.json @@ -22,16 +22,6 @@ "config": { "type": "object", "properties": { - "verbose_response": { - "type": "boolean", - "description": "If enabled, the policy returns more verbose and detailed validation errors.", - "default": false - }, - "content_type_parameter_validation": { - "type": "boolean", - "description": "Determines whether to enable parameters validation of request content-type.", - "default": true - }, "body_schema": { "type": "string", "description": "The request body schema specification. One of `body_schema` or `parameter_schema` must be specified." @@ -64,10 +54,6 @@ "items": { "type": "object", "properties": { - "explode": { - "type": "boolean", - "description": "Required when `schema` and `style` are set. When `explode` is `true`, parameter values of type `array` or `object` generate separate parameters for each value of the array or key-value pair of the map. For other types of parameters, this property has no effect." - }, "schema": { "type": "string", "description": "Required when `style` and `explode` are set. This is the schema defining the type used for the parameter. It is validated using `draft4` for JSON Schema draft 4 compliant validator. In addition to being a valid JSON Schema, the parameter schema MUST have a top-level `type` property to enable proper deserialization before validating." @@ -101,6 +87,10 @@ "spaceDelimited" ], "description": "Required when `schema` and `explode` are set. Describes how the parameter value will be deserialized depending on the type of the parameter value." + }, + "explode": { + "type": "boolean", + "description": "Required when `schema` and `style` are set. When `explode` is `true`, parameter values of type `array` or `object` generate separate parameters for each value of the array or key-value pair of the map. For other types of parameters, this property has no effect." } }, "required": [ @@ -110,6 +100,16 @@ ] }, "description": "Array of parameter validator specification. One of `body_schema` or `parameter_schema` must be specified." + }, + "verbose_response": { + "type": "boolean", + "description": "If enabled, the policy returns more verbose and detailed validation errors.", + "default": false + }, + "content_type_parameter_validation": { + "type": "boolean", + "description": "Determines whether to enable parameters validation of request content-type.", + "default": true } } }, diff --git a/app/_schemas/ai-gateway/policies/ResponseRatelimiting.json b/app/_schemas/ai-gateway/policies/ResponseRatelimiting.json index c821ac66e44..cbaaf8ba34a 100644 --- a/app/_schemas/ai-gateway/policies/ResponseRatelimiting.json +++ b/app/_schemas/ai-gateway/policies/ResponseRatelimiting.json @@ -1,8 +1,37 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "limit_by": { + "type": "string", + "enum": [ + "consumer", + "credential", + "ip" + ], + "description": "The entity that will be used when aggregating the limits: `consumer`, `credential`, `ip`. If the `consumer` or the `credential` cannot be determined, the system will always fallback to `ip`.", + "default": "consumer" + }, "policy": { "type": "string", "enum": [ @@ -21,16 +50,6 @@ "redis": { "type": "object", "properties": { - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, "port": { "type": "integer", "maximum": 65535, @@ -39,43 +58,41 @@ "default": 6379, "x-referenceable": true }, - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, "cloud_authentication": { "type": "object", "properties": { - "aws_secret_access_key": { + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_role_session_name": { "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true }, - "aws_assume_role_arn": { + "gcp_service_account_json": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", "x-referenceable": true, "x-encrypted": true }, - "gcp_service_account_json": { + "aws_access_key_id": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "aws_secret_access_key": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, @@ -94,8 +111,8 @@ "azure_tenant_id": { "type": "string", "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, "auth_provider": { "type": "string", @@ -116,25 +133,14 @@ "type": "string", "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true - }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false }, "ssl_verify": { "type": "boolean", @@ -150,6 +156,29 @@ "type": "string", "description": "A string representing a host name, such as example.com.", "x-referenceable": true + }, + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 } }, "description": "Redis configuration" @@ -196,39 +225,10 @@ "type": "string", "description": "The name of the response header used to increment the counters.", "default": "x-kong-limit" - }, - "limit_by": { - "type": "string", - "enum": [ - "consumer", - "credential", - "ip" - ], - "description": "The entity that will be used when aggregating the limits: `consumer`, `credential`, `ip`. If the `consumer` or the `credential` cannot be determined, the system will always fallback to `ip`.", - "default": "consumer" } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -236,9 +236,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -246,9 +246,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -256,7 +256,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } }, "x-supported-partials": [ diff --git a/app/_schemas/ai-gateway/policies/ResponseTransformer.json b/app/_schemas/ai-gateway/policies/ResponseTransformer.json index dd24903f229..6345fa50d18 100644 --- a/app/_schemas/ai-gateway/policies/ResponseTransformer.json +++ b/app/_schemas/ai-gateway/policies/ResponseTransformer.json @@ -1,8 +1,46 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { + "rename": { + "type": "object", + "properties": { + "headers": { + "type": "array", + "items": { + "type": "string" + }, + "default": [] + }, + "json": { + "type": "array", + "items": { + "type": "string" + }, + "default": [] + } + } + }, "replace": { "type": "object", "properties": { @@ -102,33 +140,14 @@ "remove": { "type": "object", "properties": { - "headers": { - "type": "array", - "items": { - "type": "string" - }, - "default": [] - }, "json": { "type": "array", "items": { "type": "string" }, "default": [] - } - } - }, - "rename": { - "type": "object", - "properties": { - "headers": { - "type": "array", - "items": { - "type": "string" - }, - "default": [] }, - "json": { + "headers": { "type": "array", "items": { "type": "string" @@ -139,25 +158,6 @@ } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/ResponseTransformerAdvanced.json b/app/_schemas/ai-gateway/policies/ResponseTransformerAdvanced.json index c51b13dd207..e016f9f878e 100644 --- a/app/_schemas/ai-gateway/policies/ResponseTransformerAdvanced.json +++ b/app/_schemas/ai-gateway/policies/ResponseTransformerAdvanced.json @@ -70,6 +70,13 @@ "replace": { "type": "object", "properties": { + "headers": { + "type": "array", + "items": { + "type": "string" + }, + "default": [] + }, "if_status": { "type": "array", "items": { @@ -99,13 +106,6 @@ ] }, "default": [] - }, - "headers": { - "type": "array", - "items": { - "type": "string" - }, - "default": [] } } }, diff --git a/app/_schemas/ai-gateway/policies/RouteByHeader.json b/app/_schemas/ai-gateway/policies/RouteByHeader.json index 792ca718fdd..7df6511b755 100644 --- a/app/_schemas/ai-gateway/policies/RouteByHeader.json +++ b/app/_schemas/ai-gateway/policies/RouteByHeader.json @@ -47,7 +47,7 @@ } } }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -55,9 +55,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -65,9 +65,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -75,7 +75,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/RouteTransformerAdvanced.json b/app/_schemas/ai-gateway/policies/RouteTransformerAdvanced.json index b2e2b20ba86..1e8a806a30f 100644 --- a/app/_schemas/ai-gateway/policies/RouteTransformerAdvanced.json +++ b/app/_schemas/ai-gateway/policies/RouteTransformerAdvanced.json @@ -22,6 +22,9 @@ "config": { "type": "object", "properties": { + "path": { + "type": "string" + }, "port": { "type": "string" }, @@ -31,9 +34,6 @@ "escape_path": { "type": "boolean", "default": false - }, - "path": { - "type": "string" } } }, diff --git a/app/_schemas/ai-gateway/policies/Saml.json b/app/_schemas/ai-gateway/policies/Saml.json index 9cfbab9f4b2..42e4341568c 100644 --- a/app/_schemas/ai-gateway/policies/Saml.json +++ b/app/_schemas/ai-gateway/policies/Saml.json @@ -32,87 +32,24 @@ "config": { "type": "object", "properties": { - "session_remember_cookie_name": { + "request_signing_certificate": { "type": "string", - "description": "Persistent session cookie name", - "default": "remember" - }, - "session_absolute_timeout": { - "type": "number", - "description": "The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.", - "default": 86400 - }, - "session_cookie_secure": { - "type": "boolean", - "description": "The cookie is only sent to the server when a request is made with the https:scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." - }, - "session_enforce_same_subject": { - "type": "boolean", - "description": "When set to `true`, audiences are forced to share the same subject.", - "default": false + "description": "The certificate for signing requests.", + "x-referenceable": true, + "x-encrypted": true }, - "session_hash_subject": { + "validate_assertion_signature": { "type": "boolean", - "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.", - "default": false - }, - "request_signature_algorithm": { - "type": "string", - "enum": [ - "SHA256", - "SHA384", - "SHA512" - ], - "description": "The signature algorithm for signing Authn requests. Options available are: - `SHA256` - `SHA384` - `SHA512`", - "default": "SHA256" - }, - "response_signature_algorithm": { - "type": "string", - "enum": [ - "SHA256", - "SHA384", - "SHA512" - ], - "description": "The algorithm for validating signatures in SAML responses. Options available are: - `SHA256` - `SHA384` - `SHA512`", - "default": "SHA256" - }, - "session_audience": { - "type": "string", - "description": "The session audience, for example \"my-application\"", - "default": "default" - }, - "session_remember_rolling_timeout": { - "type": "number", - "description": "Persistent session rolling timeout in seconds.", - "default": 604800 - }, - "session_remember_absolute_timeout": { - "type": "number", - "description": "Persistent session absolute timeout in seconds.", - "default": 2592000 - }, - "session_cookie_same_site": { - "type": "string", - "enum": [ - "Default", - "Lax", - "None", - "Strict" - ], - "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", - "default": "Lax" - }, - "session_memcached_port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 11211 + "description": "Controls SAML response signature validation. When enabled (the default), the `saml:Assertion` signature is validated and a valid `idp_certificate` is required. When disabled, the signature is still validated as long as an `idp_certificate` is configured, but the `samlp:Response` signature is checked instead of the assertion. Disabling it without an `idp_certificate` skips signature validation entirely, which is insecure (unsigned responses are accepted) and logs a warning.", + "default": true }, - "session_cookie_name": { + "session_secret": { "type": "string", - "description": "The session cookie name.", - "default": "session" + "maxLength": 32, + "minLength": 32, + "description": "The session secret. This must be a random string of 32 characters from the base64 alphabet (letters, numbers, `/`, `_` and `+`). It is used as the secret key for encrypting session data as well as state information that is sent to the IdP in the authentication exchange.", + "x-referenceable": true, + "x-encrypted": true }, "session_idling_timeout": { "type": "number", @@ -124,6 +61,11 @@ "description": "The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.", "default": 3600 }, + "session_cookie_http_only": { + "type": "boolean", + "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", + "default": true + }, "idp_sso_url": { "type": "string", "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." @@ -132,27 +74,26 @@ "type": "string", "description": "The unique identifier of the IdP application. Formatted as a URL containing information about the IdP so the SP can validate that the SAML assertions it receives are issued from the correct IdP." }, - "session_remember": { - "type": "boolean", - "description": "Enables or disables persistent sessions", - "default": false + "session_remember_cookie_name": { + "type": "string", + "description": "Persistent session cookie name", + "default": "remember" }, - "session_request_headers": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "absolute-timeout", - "audience", - "id", - "idling-timeout", - "rolling-timeout", - "subject", - "timeout" - ] - } + "session_memcached_prefix": { + "type": "string", + "description": "The memcached session key prefix." }, - "session_response_headers": { + "session_absolute_timeout": { + "type": "number", + "description": "The session cookie absolute timeout in seconds. Specifies how long the session can be used until it is no longer valid.", + "default": 86400 + }, + "session_cookie_path": { + "type": "string", + "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).", + "default": "/" + }, + "session_request_headers": { "type": "array", "items": { "type": "string", @@ -167,222 +108,46 @@ ] } }, - "assertion_consumer_path": { - "type": "string", - "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." - }, - "response_encryption_key": { - "type": "string", - "description": "The private encryption key required to decrypt encrypted assertions.", - "x-referenceable": true, - "x-encrypted": true - }, - "response_digest_algorithm": { - "type": "string", - "enum": [ - "SHA1", - "SHA256" - ], - "description": "The algorithm for verifying digest in SAML responses: - `SHA256` - `SHA1`", - "default": "SHA256" - }, - "nameid_format": { - "type": "string", - "enum": [ - "EmailAddress", - "Persistent", - "Transient", - "Unspecified" - ], - "description": "The requested `NameId` format. Options available are: - `Unspecified` - `EmailAddress` - `Persistent` - `Transient`", - "default": "EmailAddress" - }, - "session_store_metadata": { - "type": "boolean", - "description": "Configures whether or not session metadata should be stored. This includes information about the active sessions for the `specific_audience` belonging to a specific subject.", - "default": false - }, - "session_memcached_prefix": { - "type": "string", - "description": "The memcached session key prefix." - }, - "session_cookie_domain": { - "type": "string", - "description": "The session cookie domain flag." - }, - "session_storage": { - "type": "string", - "enum": [ - "cookie", - "memcache", - "memcached", - "redis" - ], - "description": "The session storage for session data: - `cookie`: stores session data with the session cookie. The session cannot be invalidated or revoked without changing the session secret, but is stateless, and doesn't require a database. - `memcached`: stores session data in memcached - `redis`: stores session data in Redis", - "default": "cookie" - }, - "session_memcached_socket": { - "type": "string", - "description": "The memcached unix socket path." - }, - "session_memcached_host": { - "type": "string", - "description": "The memcached host.", - "default": "127.0.0.1" - }, - "session_cookie_http_only": { - "type": "boolean", - "description": "Forbids JavaScript from accessing the cookie, for example, through the `Document.cookie` property.", - "default": true - }, - "request_signing_key": { - "type": "string", - "description": "The private key for signing requests. If this parameter is set, requests sent to the IdP are signed. The `request_signing_certificate` parameter must be set as well.", - "x-referenceable": true, - "x-encrypted": true - }, - "request_signing_certificate": { - "type": "string", - "description": "The certificate for signing requests.", - "x-referenceable": true, - "x-encrypted": true - }, - "anonymous": { - "type": "string", - "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer. If not set, a Kong Consumer must exist for the SAML IdP user credentials, mapping the username format to the Kong Consumer username." - }, - "session_secret": { - "type": "string", - "maxLength": 32, - "minLength": 32, - "description": "The session secret. This must be a random string of 32 characters from the base64 alphabet (letters, numbers, `/`, `_` and `+`). It is used as the secret key for encrypting session data as well as state information that is sent to the IdP in the authentication exchange.", - "x-encrypted": true, - "x-referenceable": true - }, - "session_cookie_path": { - "type": "string", - "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes).", - "default": "/" - }, - "session_hash_storage_key": { - "type": "boolean", - "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.", - "default": false - }, - "idp_certificate": { - "type": "string", - "description": "The public certificate provided by the IdP. This is used to validate responses from the IdP. Only include the contents of the certificate. Do not include the header (`BEGIN CERTIFICATE`) and footer (`END CERTIFICATE`) lines.", - "x-referenceable": true, - "x-encrypted": true - }, - "request_digest_algorithm": { - "type": "string", - "enum": [ - "SHA1", - "SHA256" - ], - "description": "The digest algorithm for Authn requests: - `SHA256` - `SHA1`", - "default": "SHA256" - }, - "validate_assertion_signature": { - "type": "boolean", - "description": "Controls SAML response signature validation. When enabled (the default), the `saml:Assertion` signature is validated and a valid `idp_certificate` is required. When disabled, the signature is still validated as long as an `idp_certificate` is configured, but the `samlp:Response` signature is checked instead of the assertion. Disabling it without an `idp_certificate` skips signature validation entirely, which is insecure (unsigned responses are accepted) and logs a warning.", - "default": true - }, "redis": { "type": "object", "properties": { - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true - }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 - }, - "prefix": { - "type": "string", - "description": "The Redis session key prefix." - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "read_timeout": { + "keepalive_backlog": { "type": "integer", "maximum": 2147483646, "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." }, - "username": { + "sentinel_master": { "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "ssl_verify": { - "type": "boolean", - "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", - "default": true + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "host": { + "sentinel_password": { "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true }, "cloud_authentication": { "type": "object", "properties": { + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, "auth_provider": { "type": "string", "enum": [ @@ -393,11 +158,6 @@ "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, - "aws_cache_name": { - "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", - "x-referenceable": true - }, "aws_region": { "type": "string", "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", @@ -408,113 +168,119 @@ "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", "default": true }, - "aws_access_key_id": { - "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true - }, - "gcp_service_account_json": { + "aws_assume_role_arn": { "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_id": { + "aws_role_session_name": { "type": "string", - "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true }, - "azure_client_secret": { + "azure_tenant_id": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, - "aws_secret_access_key": { + "aws_cache_name": { "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", - "x-referenceable": true, - "x-encrypted": true + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true }, - "aws_assume_role_arn": { + "aws_access_key_id": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "aws_secret_access_key": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-encrypted": true, "x-referenceable": true - }, - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." }, "sentinel_nodes": { "type": "array", "items": { "type": "object", "properties": { + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, "port": { "type": "integer", "maximum": 65535, "minimum": 0, "description": "An integer representing a port number between 0 and 65535, inclusive.", "default": 6379 - }, - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" } } }, "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "connection_is_proxied": { + "ssl": { "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "description": "If set to true, uses SSL to connect to Redis.", "default": false }, - "socket": { - "type": "string", - "description": "The Redis unix socket path." + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true }, "password": { "type": "string", "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, "sentinel_username": { "type": "string", "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", "x-referenceable": true }, - "database": { - "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true }, - "sentinel_master": { + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "host": { "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true }, "connect_timeout": { "type": "integer", @@ -530,13 +296,247 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "sentinel_password": { + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "prefix": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-referenceable": true, - "x-encrypted": true + "description": "The Redis session key prefix." + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "socket": { + "type": "string", + "description": "The Redis unix socket path." } } + }, + "nameid_format": { + "type": "string", + "enum": [ + "EmailAddress", + "Persistent", + "Transient", + "Unspecified" + ], + "description": "The requested `NameId` format. Options available are: - `Unspecified` - `EmailAddress` - `Persistent` - `Transient`", + "default": "EmailAddress" + }, + "session_cookie_name": { + "type": "string", + "description": "The session cookie name.", + "default": "session" + }, + "session_store_metadata": { + "type": "boolean", + "description": "Configures whether or not session metadata should be stored. This includes information about the active sessions for the `specific_audience` belonging to a specific subject.", + "default": false + }, + "response_encryption_key": { + "type": "string", + "description": "The private encryption key required to decrypt encrypted assertions.", + "x-referenceable": true, + "x-encrypted": true + }, + "response_signature_algorithm": { + "type": "string", + "enum": [ + "SHA256", + "SHA384", + "SHA512" + ], + "description": "The algorithm for validating signatures in SAML responses. Options available are: - `SHA256` - `SHA384` - `SHA512`", + "default": "SHA256" + }, + "session_remember": { + "type": "boolean", + "description": "Enables or disables persistent sessions", + "default": false + }, + "session_cookie_same_site": { + "type": "string", + "enum": [ + "Default", + "Lax", + "None", + "Strict" + ], + "description": "Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks.", + "default": "Lax" + }, + "session_memcached_socket": { + "type": "string", + "description": "The memcached unix socket path." + }, + "idp_certificate": { + "type": "string", + "description": "The public certificate provided by the IdP. This is used to validate responses from the IdP. Only include the contents of the certificate. Do not include the header (`BEGIN CERTIFICATE`) and footer (`END CERTIFICATE`) lines.", + "x-referenceable": true, + "x-encrypted": true + }, + "request_signing_key": { + "type": "string", + "description": "The private key for signing requests. If this parameter is set, requests sent to the IdP are signed. The `request_signing_certificate` parameter must be set as well.", + "x-referenceable": true, + "x-encrypted": true + }, + "request_signature_algorithm": { + "type": "string", + "enum": [ + "SHA256", + "SHA384", + "SHA512" + ], + "description": "The signature algorithm for signing Authn requests. Options available are: - `SHA256` - `SHA384` - `SHA512`", + "default": "SHA256" + }, + "request_digest_algorithm": { + "type": "string", + "enum": [ + "SHA1", + "SHA256" + ], + "description": "The digest algorithm for Authn requests: - `SHA256` - `SHA1`", + "default": "SHA256" + }, + "session_audience": { + "type": "string", + "description": "The session audience, for example \"my-application\"", + "default": "default" + }, + "session_remember_rolling_timeout": { + "type": "number", + "description": "Persistent session rolling timeout in seconds.", + "default": 604800 + }, + "session_cookie_secure": { + "type": "boolean", + "description": "The cookie is only sent to the server when a request is made with the https:scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks." + }, + "session_storage": { + "type": "string", + "enum": [ + "cookie", + "memcache", + "memcached", + "redis" + ], + "description": "The session storage for session data: - `cookie`: stores session data with the session cookie. The session cannot be invalidated or revoked without changing the session secret, but is stateless, and doesn't require a database. - `memcached`: stores session data in memcached - `redis`: stores session data in Redis", + "default": "cookie" + }, + "assertion_consumer_path": { + "type": "string", + "description": "A string representing a URL path, such as /path/to/resource. Must start with a forward slash (/) and must not contain empty segments (i.e., two consecutive forward slashes)." + }, + "response_digest_algorithm": { + "type": "string", + "enum": [ + "SHA1", + "SHA256" + ], + "description": "The algorithm for verifying digest in SAML responses: - `SHA256` - `SHA1`", + "default": "SHA256" + }, + "session_remember_absolute_timeout": { + "type": "number", + "description": "Persistent session absolute timeout in seconds.", + "default": 2592000 + }, + "session_enforce_same_subject": { + "type": "boolean", + "description": "When set to `true`, audiences are forced to share the same subject.", + "default": false + }, + "session_memcached_host": { + "type": "string", + "description": "The memcached host.", + "default": "127.0.0.1" + }, + "session_memcached_port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 11211 + }, + "anonymous": { + "type": "string", + "description": "An optional string (consumer UUID or username) value to use as an “anonymous” consumer. If not set, a Kong Consumer must exist for the SAML IdP user credentials, mapping the username format to the Kong Consumer username." + }, + "session_cookie_domain": { + "type": "string", + "description": "The session cookie domain flag." + }, + "session_response_headers": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "absolute-timeout", + "audience", + "id", + "idling-timeout", + "rolling-timeout", + "subject", + "timeout" + ] + } + }, + "session_hash_subject": { + "type": "boolean", + "description": "When set to `true`, the value of subject is hashed before being stored. Only applies when `session_store_metadata` is enabled.", + "default": false + }, + "session_hash_storage_key": { + "type": "boolean", + "description": "When set to `true`, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.", + "default": false } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/ServiceProtection.json b/app/_schemas/ai-gateway/policies/ServiceProtection.json index 4e32bd0e1e1..621e83b1d84 100644 --- a/app/_schemas/ai-gateway/policies/ServiceProtection.json +++ b/app/_schemas/ai-gateway/policies/ServiceProtection.json @@ -1,40 +1,30 @@ { "properties": { - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "description": "A set of strings representing HTTP protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, "config": { "type": "object", "properties": { - "retry_after_jitter_max": { - "type": "number", - "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.", - "default": 0 + "strategy": { + "type": "string", + "enum": [ + "cluster", + "local", + "redis" + ], + "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local`, `redis` and `cluster`.", + "default": "local" + }, + "hide_client_headers": { + "type": "boolean", + "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.", + "default": false }, "redis": { "type": "object", "properties": { - "host": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1", - "x-referenceable": true + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 }, "port": { "type": "integer", @@ -44,6 +34,40 @@ "default": 6379, "x-referenceable": true }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, "database": { "type": "integer", "description": "Database to use for the Redis connection when using the `redis` strategy", @@ -53,33 +77,72 @@ "type": "string", "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." }, - "cluster_max_redirections": { - "type": "integer", - "description": "Maximum retry attempts for redirection.", - "default": 5 + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true }, "connection_is_proxied": { "type": "boolean", "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", "default": false }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true }, - "read_timeout": { + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "keepalive_backlog": { "type": "integer", "maximum": 2147483646, "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." }, - "sentinel_password": { + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "host": { "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", "x-referenceable": true, "x-encrypted": true }, @@ -101,20 +164,15 @@ "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_is_serverless": { - "type": "boolean", - "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", - "default": true - }, - "aws_access_key_id": { + "aws_secret_access_key": { "type": "string", - "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "aws_secret_access_key": { + "aws_role_session_name": { "type": "string", - "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "description": "The session name for the temporary credentials when assuming the IAM role.", "x-referenceable": true, "x-encrypted": true }, @@ -127,12 +185,6 @@ "azure_client_secret": { "type": "string", "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", - "x-encrypted": true, - "x-referenceable": true - }, - "azure_tenant_id": { - "type": "string", - "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, @@ -141,15 +193,20 @@ "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, - "aws_assume_role_arn": { + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_access_key_id": { "type": "string", - "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { + "aws_assume_role_arn": { "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", "x-referenceable": true, "x-encrypted": true }, @@ -158,6 +215,12 @@ "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", "x-referenceable": true, "x-encrypted": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." @@ -184,100 +247,42 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, - "keepalive_pool_size": { - "type": "integer", - "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 - }, - "sentinel_role": { - "type": "string", - "enum": [ - "any", - "master", - "slave" - ], - "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." - }, "ssl": { "type": "boolean", "description": "If set to true, uses SSL to connect to Redis.", "default": false }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "password": { - "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true - }, - "keepalive_backlog": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "cluster_nodes": { - "type": "array", - "items": { - "type": "object", - "properties": { - "ip": { - "type": "string", - "description": "A string representing a host name, such as example.com.", - "default": "127.0.0.1" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379 - } - } - }, - "minLength": 1, - "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." - }, "ssl_verify": { "type": "boolean", "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", "default": true - }, - "server_name": { - "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", - "x-referenceable": true } } }, - "disable_penalty": { - "type": "boolean", - "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type.", - "default": false - }, "error_code": { "type": "number", "description": "Set a custom error code to return when the rate limit is exceeded.", "default": 429 }, + "error_message": { + "type": "string", + "description": "Set a custom error message to return when the rate limit is exceeded.", + "default": "API rate limit exceeded" + }, + "window_size": { + "type": "array", + "items": { + "type": "number" + }, + "description": "One or more window sizes to apply a limit to (defined in seconds). There must be a matching number of window limits and sizes specified." + }, + "limit": { + "type": "array", + "items": { + "type": "number" + }, + "description": "One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified." + }, "sync_rate": { "type": "number", "description": "How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms)." @@ -296,23 +301,16 @@ "description": "The shared dictionary where concurrency control locks are stored. The default shared dictionary is `kong_locks`. The shared dictionary should be declared in nginx-kong.conf.", "default": "kong_locks" }, - "hide_client_headers": { + "retry_after_jitter_max": { + "type": "number", + "description": "The upper bound of a jitter (random delay) in seconds to be added to the `Retry-After` header of denied requests (status = `429`) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is `0`; in this case, the `Retry-After` header is equal to the `RateLimit-Reset` header.", + "default": 0 + }, + "disable_penalty": { "type": "boolean", - "description": "Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters.", + "description": "If set to `true`, this doesn't count denied requests (status = `429`). If set to `false`, all requests, including denied ones, are counted. This parameter only affects the `sliding` window_type.", "default": false }, - "error_message": { - "type": "string", - "description": "Set a custom error message to return when the rate limit is exceeded.", - "default": "API rate limit exceeded" - }, - "window_size": { - "type": "array", - "items": { - "type": "number" - }, - "description": "One or more window sizes to apply a limit to (defined in seconds). There must be a matching number of window limits and sizes specified." - }, "window_type": { "type": "string", "enum": [ @@ -321,23 +319,6 @@ ], "description": "Sets the time window type to either `sliding` (default) or `fixed`. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window's counters.", "default": "sliding" - }, - "limit": { - "type": "array", - "items": { - "type": "number" - }, - "description": "One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified." - }, - "strategy": { - "type": "string", - "enum": [ - "cluster", - "local", - "redis" - ], - "description": "The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are: `local`, `redis` and `cluster`.", - "default": "local" } }, "required": [ @@ -345,6 +326,25 @@ "window_size" ] }, + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "service": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/Session.json b/app/_schemas/ai-gateway/policies/Session.json index bb47e034bf6..453fbc8ea80 100644 --- a/app/_schemas/ai-gateway/policies/Session.json +++ b/app/_schemas/ai-gateway/policies/Session.json @@ -1,40 +1,69 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "tcp", + "tls", + "tls_passthrough", + "udp", + "ws", + "wss" + ], + "description": "A string representing a protocol, such as HTTP or HTTPS." + }, + "description": "A set of strings representing protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "model": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "description": "Custom type for representing a foreign key with a null value allowed.", + "x-foreign": true + }, "config": { "type": "object", "properties": { - "cookie_name": { + "secret": { "type": "string", - "description": "The name of the cookie.", - "default": "session" + "description": "The secret that is used in keyed HMAC generation.", + "x-encrypted": true, + "x-referenceable": true }, - "bind": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "ip", - "scheme", - "user-agent" - ] - }, - "description": "Bind the session to data acquired from the HTTP request or connection." + "audience": { + "type": "string", + "description": "The session audience, which is the intended target application. For example `\"my-application\"`.", + "default": "default" }, - "response_headers": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "absolute-timeout", - "audience", - "id", - "idling-timeout", - "rolling-timeout", - "subject", - "timeout" - ] - }, - "description": "List of information to include, as headers, in the response to the downstream." + "idling_timeout": { + "type": "number", + "description": "The session cookie idle time, in seconds.", + "default": 900 + }, + "cookie_path": { + "type": "string", + "description": "The resource in the host where the cookie is available.", + "default": "/" + }, + "remember_cookie_name": { + "type": "string", + "description": "Persistent session cookie name. Use with the `remember` configuration parameter.", + "default": "remember" }, "read_body_for_logout": { "type": "boolean", @@ -56,11 +85,38 @@ "POST" ] }, - "secret": { + "logout_post_arg": { "type": "string", - "description": "The secret that is used in keyed HMAC generation.", - "x-referenceable": true, - "x-encrypted": true + "description": "The POST argument passed to logout requests. Do not change this property.", + "default": "session_logout" + }, + "storage": { + "type": "string", + "enum": [ + "cookie", + "kong" + ], + "description": "Determines where the session data is stored. `kong`: Stores encrypted session data into Kong's current database strategy; the cookie will not contain any session data. `cookie`: Stores encrypted session data within the cookie itself.", + "default": "cookie" + }, + "rolling_timeout": { + "type": "number", + "description": "The session cookie rolling timeout, in seconds. Specifies how long the session can be used until it needs to be renewed.", + "default": 3600 + }, + "stale_ttl": { + "type": "number", + "description": "The duration, in seconds, after which an old cookie is discarded, starting from the moment when the session becomes outdated and is replaced by a new one.", + "default": 10 + }, + "cookie_name": { + "type": "string", + "description": "The name of the cookie.", + "default": "session" + }, + "cookie_domain": { + "type": "string", + "description": "The domain with which the cookie is intended to be exchanged." }, "cookie_same_site": { "type": "string", @@ -73,153 +129,97 @@ "description": "Determines whether and how a cookie may be sent with cross-site requests.", "default": "Strict" }, + "remember": { + "type": "boolean", + "description": "Enables or disables persistent sessions.", + "default": false + }, + "cookie_http_only": { + "type": "boolean", + "description": "Applies the `HttpOnly` tag so that the cookie is sent only to a server.", + "default": true + }, "cookie_secure": { "type": "boolean", "description": "Applies the Secure directive so that the cookie may be sent to the server only with an encrypted request over the HTTPS protocol.", "default": true }, - "remember_cookie_name": { - "type": "string", - "description": "Persistent session cookie name. Use with the `remember` configuration parameter.", - "default": "remember" - }, "remember_rolling_timeout": { "type": "number", "description": "The persistent session rolling timeout window, in seconds.", "default": 604800 }, - "request_headers": { + "bind": { "type": "array", "items": { "type": "string", "enum": [ - "absolute-timeout", - "audience", - "id", - "idling-timeout", - "rolling-timeout", - "subject", - "timeout" + "ip", + "scheme", + "user-agent" ] }, - "description": "List of information to include, as headers, in the response to the downstream." + "description": "Bind the session to data acquired from the HTTP request or connection." }, "logout_query_arg": { "type": "string", "description": "The query argument passed to logout requests.", "default": "session_logout" }, - "logout_post_arg": { - "type": "string", - "description": "The POST argument passed to logout requests. Do not change this property.", - "default": "session_logout" + "hash_subject": { + "type": "boolean", + "description": "Whether to hash or not the subject when store_metadata is enabled.", + "default": false }, - "rolling_timeout": { - "type": "number", - "description": "The session cookie rolling timeout, in seconds. Specifies how long the session can be used until it needs to be renewed.", - "default": 3600 + "store_metadata": { + "type": "boolean", + "description": "Whether to also store metadata of sessions, such as collecting data of sessions for a specific audience belonging to a specific subject.", + "default": false }, "absolute_timeout": { "type": "number", "description": "The session cookie absolute timeout, in seconds. Specifies how long the session can be used until it is no longer valid.", "default": 86400 }, - "stale_ttl": { - "type": "number", - "description": "The duration, in seconds, after which an old cookie is discarded, starting from the moment when the session becomes outdated and is replaced by a new one.", - "default": 10 - }, - "cookie_path": { - "type": "string", - "description": "The resource in the host where the cookie is available.", - "default": "/" - }, - "cookie_http_only": { - "type": "boolean", - "description": "Applies the `HttpOnly` tag so that the cookie is sent only to a server.", - "default": true - }, - "remember": { - "type": "boolean", - "description": "Enables or disables persistent sessions.", - "default": false - }, "remember_absolute_timeout": { "type": "number", "description": "The persistent session absolute timeout limit, in seconds.", "default": 2592000 }, - "hash_subject": { - "type": "boolean", - "description": "Whether to hash or not the subject when store_metadata is enabled.", - "default": false - }, - "audience": { - "type": "string", - "description": "The session audience, which is the intended target application. For example `\"my-application\"`.", - "default": "default" - }, - "idling_timeout": { - "type": "number", - "description": "The session cookie idle time, in seconds.", - "default": 900 - }, - "cookie_domain": { - "type": "string", - "description": "The domain with which the cookie is intended to be exchanged." - }, - "store_metadata": { - "type": "boolean", - "description": "Whether to also store metadata of sessions, such as collecting data of sessions for a specific audience belonging to a specific subject.", - "default": false + "response_headers": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "absolute-timeout", + "audience", + "id", + "idling-timeout", + "rolling-timeout", + "subject", + "timeout" + ] + }, + "description": "List of information to include, as headers, in the response to the downstream." }, - "storage": { - "type": "string", - "enum": [ - "cookie", - "kong" - ], - "description": "Determines where the session data is stored. `kong`: Stores encrypted session data into Kong's current database strategy; the cookie will not contain any session data. `cookie`: Stores encrypted session data within the cookie itself.", - "default": "cookie" + "request_headers": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "absolute-timeout", + "audience", + "id", + "idling-timeout", + "rolling-timeout", + "subject", + "timeout" + ] + }, + "description": "List of information to include, as headers, in the response to the downstream." } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "tcp", - "tls", - "tls_passthrough", - "udp", - "ws", - "wss" - ], - "description": "A string representing a protocol, such as HTTP or HTTPS." - }, - "description": "A set of strings representing protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "model": { - "type": "object", - "properties": { - "id": { - "type": "string" - } - }, - "description": "Custom type for representing a foreign key with a null value allowed.", - "x-foreign": true - }, "route": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/SolaceConsume.json b/app/_schemas/ai-gateway/policies/SolaceConsume.json index 215524c3402..3939a4705f9 100644 --- a/app/_schemas/ai-gateway/policies/SolaceConsume.json +++ b/app/_schemas/ai-gateway/policies/SolaceConsume.json @@ -22,36 +22,53 @@ "config": { "type": "object", "properties": { - "session": { + "polling": { "type": "object", "properties": { - "generate_send_timestamps": { - "type": "boolean", - "description": "When enabled, a send timestamp is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true + "timeout": { + "type": "integer", + "maximum": 300000, + "minimum": 0, + "description": "Polling timeout in milliseconds. When set to `0`, the polling works like short-polling and waits at maximum the Flow `wait_timeout` amount of time for the new messages (short-polling). When set to larger than `0`, the connection is kept open and only closed after the timeout or in case messages appear earlier (long-polling).", + "default": 0 + } + }, + "description": "The `POLLING` mode related configuration settings." + }, + "websocket": { + "type": "object", + "properties": { + "timeout": { + "type": "integer", + "maximum": 60000, + "minimum": 1, + "description": "Specifies the network timeout threshold in milliseconds.", + "default": 1000 }, - "generate_sender_id": { - "type": "boolean", - "description": "When enabled, a sender id is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true + "max_recv_len": { + "type": "integer", + "description": "Specifies the maximal length of payload allowed when receiving WebSocket frames.", + "default": 65536 + }, + "max_send_len": { + "type": "integer", + "description": "Specifies the maximal length of payload allowed when sending WebSocket frames.", + "default": 65536 + } + }, + "description": "The `WEBSOCKET` mode related configuration settings." + }, + "session": { + "type": "object", + "properties": { + "host": { + "type": "string", + "description": "The IPv4 or IPv6 address or host name to connect to (see: https://docs.solace.com/API-Developer-Online-Ref-Documentation/c/index.html#host-entry).", + "x-referenceable": true }, "authentication": { "type": "object", "properties": { - "username": { - "type": "string", - "maxLength": 189, - "description": "The username used with `BASIC` authentication scheme when connecting to an event broker.", - "x-referenceable": true, - "x-encrypted": true - }, - "password": { - "type": "string", - "maxLength": 128, - "description": "The password used with `BASIC` authentication scheme when connecting to an event broker.", - "x-referenceable": true, - "x-encrypted": true - }, "basic_auth_header": { "type": "string", "description": "Specifies the header that contains Basic Authentication credentials for the `BASIC` authentication scheme when connecting to an event broker. This header takes precedence over the `username` and `password` fields." @@ -85,10 +102,39 @@ ], "description": "The client authentication scheme used when connection to an event broker.", "default": "BASIC" + }, + "username": { + "type": "string", + "maxLength": 189, + "description": "The username used with `BASIC` authentication scheme when connecting to an event broker.", + "x-referenceable": true, + "x-encrypted": true + }, + "password": { + "type": "string", + "maxLength": 128, + "description": "The password used with `BASIC` authentication scheme when connecting to an event broker.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Session authentication related configuration." }, + "generate_send_timestamps": { + "type": "boolean", + "description": "When enabled, a send timestamp is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true + }, + "generate_sequence_number": { + "type": "boolean", + "description": "When enabled, a sequence number is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true + }, + "vpn_name": { + "type": "string", + "maxLength": 32, + "description": "The name of the Message VPN to attempt to join when connecting to an event broker." + }, "connect_timeout": { "type": "integer", "maximum": 100000, @@ -101,9 +147,19 @@ "description": "Indicates whether the API should validate server certificates with the trusted certificates.", "default": true }, - "generate_sequence_number": { + "calculate_message_expiry": { "type": "boolean", - "description": "When enabled, a sequence number is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "description": "If this property is true and time-to-live has a positive value in a message, the expiration time is calculated when the message is sent or received", + "default": true + }, + "generate_rcv_timestamps": { + "type": "boolean", + "description": "When enabled, a receive timestamp is recorded for each message.", + "default": true + }, + "generate_sender_id": { + "type": "boolean", + "description": "When enabled, a sender id is automatically included (if not already present) in the Solace-defined fields for each message sent.", "default": true }, "properties": { @@ -114,26 +170,6 @@ "x-lua-required": true }, "description": "Additional Solace session properties (each setting needs to have `SESSION_` prefix)." - }, - "host": { - "type": "string", - "description": "The IPv4 or IPv6 address or host name to connect to (see: https://docs.solace.com/API-Developer-Online-Ref-Documentation/c/index.html#host-entry).", - "x-referenceable": true - }, - "vpn_name": { - "type": "string", - "maxLength": 32, - "description": "The name of the Message VPN to attempt to join when connecting to an event broker." - }, - "calculate_message_expiry": { - "type": "boolean", - "description": "If this property is true and time-to-live has a positive value in a message, the expiration time is calculated when the message is sent or received", - "default": true - }, - "generate_rcv_timestamps": { - "type": "boolean", - "description": "When enabled, a receive timestamp is recorded for each message.", - "default": true } }, "required": [ @@ -144,32 +180,6 @@ "flow": { "type": "object", "properties": { - "max_unacked_messages": { - "type": "integer", - "description": "This property controls the maximum number of messages that may be unacknowledged on the Flow.", - "default": -1 - }, - "window_size": { - "type": "integer", - "maximum": 255, - "minimum": 1, - "description": "The Guaranteed message window size for the Flow.", - "default": 255 - }, - "wait_timeout": { - "type": "integer", - "maximum": 5000, - "minimum": 1, - "description": "Specifies in milliseconds how long to wait for messages to appear on each poll before giving up or retrying.", - "default": 50 - }, - "functions": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The Lua functions that manipulates the message being received from Solace. The `message` variable can be used to access the current message content, and the function can return a new content." - }, "properties": { "type": "object", "additionalProperties": { @@ -215,6 +225,32 @@ ], "description": "Controls how acknowledgments are generated for received Guaranteed messages. When set to `AUTO`, the messages are positively acknowledged upon receiving them. When set to 'CLIENT', the messages are positively or negatively acknowledged by Kong regarding to client delivery status.", "default": "CLIENT" + }, + "max_unacked_messages": { + "type": "integer", + "description": "This property controls the maximum number of messages that may be unacknowledged on the Flow.", + "default": -1 + }, + "window_size": { + "type": "integer", + "maximum": 255, + "minimum": 1, + "description": "The Guaranteed message window size for the Flow.", + "default": 255 + }, + "wait_timeout": { + "type": "integer", + "maximum": 5000, + "minimum": 1, + "description": "Specifies in milliseconds how long to wait for messages to appear on each poll before giving up or retrying.", + "default": 50 + }, + "functions": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The Lua functions that manipulates the message being received from Solace. The `message` variable can be used to access the current message content, and the function can return a new content." } }, "required": [ @@ -232,42 +268,6 @@ ], "description": "The mode of operation for the policy. The `AUTO` determines the mode automatically from the client request.", "default": "POLLING" - }, - "polling": { - "type": "object", - "properties": { - "timeout": { - "type": "integer", - "maximum": 300000, - "minimum": 0, - "description": "Polling timeout in milliseconds. When set to `0`, the polling works like short-polling and waits at maximum the Flow `wait_timeout` amount of time for the new messages (short-polling). When set to larger than `0`, the connection is kept open and only closed after the timeout or in case messages appear earlier (long-polling).", - "default": 0 - } - }, - "description": "The `POLLING` mode related configuration settings." - }, - "websocket": { - "type": "object", - "properties": { - "max_recv_len": { - "type": "integer", - "description": "Specifies the maximal length of payload allowed when receiving WebSocket frames.", - "default": 65536 - }, - "max_send_len": { - "type": "integer", - "description": "Specifies the maximal length of payload allowed when sending WebSocket frames.", - "default": 65536 - }, - "timeout": { - "type": "integer", - "maximum": 60000, - "minimum": 1, - "description": "Specifies the network timeout threshold in milliseconds.", - "default": 1000 - } - }, - "description": "The `WEBSOCKET` mode related configuration settings." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/SolaceLog.json b/app/_schemas/ai-gateway/policies/SolaceLog.json index cf75f2900e4..498bc979df7 100644 --- a/app/_schemas/ai-gateway/policies/SolaceLog.json +++ b/app/_schemas/ai-gateway/policies/SolaceLog.json @@ -29,74 +29,9 @@ "session": { "type": "object", "properties": { - "ssl_validate_certificate": { - "type": "boolean", - "description": "Indicates whether the API should validate server certificates with the trusted certificates.", - "default": true - }, - "generate_rcv_timestamps": { - "type": "boolean", - "description": "When enabled, a receive timestamp is recorded for each message.", - "default": true - }, - "generate_send_timestamps": { - "type": "boolean", - "description": "When enabled, a send timestamp is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true - }, - "properties": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-lua-required": true, - "x-referenceable": true - }, - "description": "Additional Solace session properties (each setting needs to have `SESSION_` prefix)." - }, - "calculate_message_expiry": { - "type": "boolean", - "description": "If this property is true and time-to-live has a positive value in a message, the expiration time is calculated when the message is sent or received", - "default": true - }, - "generate_sender_id": { - "type": "boolean", - "description": "When enabled, a sender id is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true - }, - "generate_sequence_number": { - "type": "boolean", - "description": "When enabled, a sequence number is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true - }, - "host": { - "type": "string", - "description": "The IPv4 or IPv6 address or host name to connect to (see: https://docs.solace.com/API-Developer-Online-Ref-Documentation/c/index.html#host-entry).", - "x-referenceable": true - }, - "vpn_name": { - "type": "string", - "maxLength": 32, - "description": "The name of the Message VPN to attempt to join when connecting to an event broker." - }, "authentication": { "type": "object", "properties": { - "access_token": { - "type": "string", - "description": "The OAuth2 access token used with `OAUTH2` authentication scheme when connecting to an event broker.", - "x-referenceable": true, - "x-encrypted": true - }, - "access_token_header": { - "type": "string", - "description": "Specifies the header that contains access token for the `OAUTH2` authentication scheme when connecting to an event broker. This header takes precedence over the `access_token` field." - }, - "id_token": { - "type": "string", - "description": "The OpenID Connect ID token used with `OAUTH2` authentication scheme when connecting to an event broker.", - "x-referenceable": true, - "x-encrypted": true - }, "id_token_header": { "type": "string", "description": "Specifies the header that contains id token for the `OAUTH2` authentication scheme when connecting to an event broker. This header takes precedence over the `id_token` field." @@ -122,22 +57,87 @@ "type": "string", "maxLength": 128, "description": "The password used with `BASIC` authentication scheme when connecting to an event broker.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "basic_auth_header": { "type": "string", "description": "Specifies the header that contains Basic Authentication credentials for the `BASIC` authentication scheme when connecting to an event broker. This header takes precedence over the `username` and `password` fields." + }, + "access_token": { + "type": "string", + "description": "The OAuth2 access token used with `OAUTH2` authentication scheme when connecting to an event broker.", + "x-referenceable": true, + "x-encrypted": true + }, + "access_token_header": { + "type": "string", + "description": "Specifies the header that contains access token for the `OAUTH2` authentication scheme when connecting to an event broker. This header takes precedence over the `access_token` field." + }, + "id_token": { + "type": "string", + "description": "The OpenID Connect ID token used with `OAUTH2` authentication scheme when connecting to an event broker.", + "x-referenceable": true, + "x-encrypted": true } }, "description": "Session authentication related configuration." }, + "ssl_validate_certificate": { + "type": "boolean", + "description": "Indicates whether the API should validate server certificates with the trusted certificates.", + "default": true + }, + "generate_send_timestamps": { + "type": "boolean", + "description": "When enabled, a send timestamp is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true + }, + "generate_sender_id": { + "type": "boolean", + "description": "When enabled, a sender id is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true + }, + "properties": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true, + "x-lua-required": true + }, + "description": "Additional Solace session properties (each setting needs to have `SESSION_` prefix)." + }, + "host": { + "type": "string", + "description": "The IPv4 or IPv6 address or host name to connect to (see: https://docs.solace.com/API-Developer-Online-Ref-Documentation/c/index.html#host-entry).", + "x-referenceable": true + }, + "vpn_name": { + "type": "string", + "maxLength": 32, + "description": "The name of the Message VPN to attempt to join when connecting to an event broker." + }, "connect_timeout": { "type": "integer", "maximum": 100000, "minimum": 100, "description": "The timeout period (in milliseconds) for a connect operation to a given host (per host).", "default": 3000 + }, + "calculate_message_expiry": { + "type": "boolean", + "description": "If this property is true and time-to-live has a positive value in a message, the expiration time is calculated when the message is sent or received", + "default": true + }, + "generate_rcv_timestamps": { + "type": "boolean", + "description": "When enabled, a receive timestamp is recorded for each message.", + "default": true + }, + "generate_sequence_number": { + "type": "boolean", + "description": "When enabled, a sequence number is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true } }, "required": [ @@ -148,29 +148,12 @@ "message": { "type": "object", "properties": { - "priority": { - "type": "integer", - "maximum": 255, - "minimum": 0, - "description": "Sets the log message priority.", - "default": 4 - }, - "dmq_eligible": { - "type": "boolean", - "description": "Sets the dead message queue (DMQ) eligible property on the log message.", - "default": false - }, - "ttl": { + "ack_timeout": { "type": "integer", - "description": "Sets the time to live (TTL) in milliseconds for the log message. Setting the time to live to zero disables the TTL for the log message.", - "default": 0 - }, - "custom_fields_by_lua": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "A key-value map that dynamically modifies log fields using Lua code." + "maximum": 100000, + "minimum": 1, + "description": "When using a non-DIRECT guaranteed delivery mode, this property sets the log message acknowledgement timeout (waiting time).", + "default": 2000 }, "tracing": { "type": "boolean", @@ -208,6 +191,22 @@ "minLength": 1, "description": "The log message destinations." }, + "sender_id": { + "type": "string", + "description": "Allows the application to set the sender identifier." + }, + "ttl": { + "type": "integer", + "description": "Sets the time to live (TTL) in milliseconds for the log message. Setting the time to live to zero disables the TTL for the log message.", + "default": 0 + }, + "custom_fields_by_lua": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "A key-value map that dynamically modifies log fields using Lua code." + }, "delivery_mode": { "type": "string", "enum": [ @@ -217,16 +216,17 @@ "description": "Sets the log message delivery mode.", "default": "DIRECT" }, - "sender_id": { - "type": "string", - "description": "Allows the application to set the sender identifier." - }, - "ack_timeout": { + "priority": { "type": "integer", - "maximum": 100000, - "minimum": 1, - "description": "When using a non-DIRECT guaranteed delivery mode, this property sets the log message acknowledgement timeout (waiting time).", - "default": 2000 + "maximum": 255, + "minimum": 0, + "description": "Sets the log message priority.", + "default": 4 + }, + "dmq_eligible": { + "type": "boolean", + "description": "Sets the dead message queue (DMQ) eligible property on the log message.", + "default": false } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/SolaceUpstream.json b/app/_schemas/ai-gateway/policies/SolaceUpstream.json index 258bddfd246..aea6e74276a 100644 --- a/app/_schemas/ai-gateway/policies/SolaceUpstream.json +++ b/app/_schemas/ai-gateway/policies/SolaceUpstream.json @@ -25,65 +25,19 @@ "session": { "type": "object", "properties": { - "connect_timeout": { - "type": "integer", - "maximum": 100000, - "minimum": 100, - "description": "The timeout period (in milliseconds) for a connect operation to a given host (per host).", - "default": 3000 - }, - "ssl_validate_certificate": { - "type": "boolean", - "description": "Indicates whether the API should validate server certificates with the trusted certificates.", - "default": true - }, - "calculate_message_expiry": { - "type": "boolean", - "description": "If this property is true and time-to-live has a positive value in a message, the expiration time is calculated when the message is sent or received", - "default": true - }, - "generate_rcv_timestamps": { - "type": "boolean", - "description": "When enabled, a receive timestamp is recorded for each message.", - "default": true - }, - "generate_sender_id": { - "type": "boolean", - "description": "When enabled, a sender id is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true - }, - "generate_sequence_number": { - "type": "boolean", - "description": "When enabled, a sequence number is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true - }, - "vpn_name": { - "type": "string", - "maxLength": 32, - "description": "The name of the Message VPN to attempt to join when connecting to an event broker." - }, - "generate_send_timestamps": { - "type": "boolean", - "description": "When enabled, a send timestamp is automatically included (if not already present) in the Solace-defined fields for each message sent.", - "default": true - }, - "properties": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true, - "x-lua-required": true - }, - "description": "Additional Solace session properties (each setting needs to have `SESSION_` prefix)." - }, - "host": { - "type": "string", - "description": "The IPv4 or IPv6 address or host name to connect to (see: https://docs.solace.com/API-Developer-Online-Ref-Documentation/c/index.html#host-entry).", - "x-referenceable": true - }, "authentication": { "type": "object", "properties": { + "basic_auth_header": { + "type": "string", + "description": "Specifies the header that contains Basic Authentication credentials for the `BASIC` authentication scheme when connecting to an event broker. This header takes precedence over the `username` and `password` fields." + }, + "access_token": { + "type": "string", + "description": "The OAuth2 access token used with `OAUTH2` authentication scheme when connecting to an event broker.", + "x-encrypted": true, + "x-referenceable": true + }, "access_token_header": { "type": "string", "description": "Specifies the header that contains access token for the `OAUTH2` authentication scheme when connecting to an event broker. This header takes precedence over the `access_token` field." @@ -112,8 +66,8 @@ "type": "string", "maxLength": 189, "description": "The username used with `BASIC` authentication scheme when connecting to an event broker.", - "x-encrypted": true, - "x-referenceable": true + "x-referenceable": true, + "x-encrypted": true }, "password": { "type": "string", @@ -121,19 +75,65 @@ "description": "The password used with `BASIC` authentication scheme when connecting to an event broker.", "x-referenceable": true, "x-encrypted": true - }, - "basic_auth_header": { - "type": "string", - "description": "Specifies the header that contains Basic Authentication credentials for the `BASIC` authentication scheme when connecting to an event broker. This header takes precedence over the `username` and `password` fields." - }, - "access_token": { - "type": "string", - "description": "The OAuth2 access token used with `OAUTH2` authentication scheme when connecting to an event broker.", - "x-referenceable": true, - "x-encrypted": true } }, "description": "Session authentication related configuration." + }, + "connect_timeout": { + "type": "integer", + "maximum": 100000, + "minimum": 100, + "description": "The timeout period (in milliseconds) for a connect operation to a given host (per host).", + "default": 3000 + }, + "ssl_validate_certificate": { + "type": "boolean", + "description": "Indicates whether the API should validate server certificates with the trusted certificates.", + "default": true + }, + "calculate_message_expiry": { + "type": "boolean", + "description": "If this property is true and time-to-live has a positive value in a message, the expiration time is calculated when the message is sent or received", + "default": true + }, + "generate_sender_id": { + "type": "boolean", + "description": "When enabled, a sender id is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true + }, + "generate_sequence_number": { + "type": "boolean", + "description": "When enabled, a sequence number is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true + }, + "properties": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true, + "x-lua-required": true + }, + "description": "Additional Solace session properties (each setting needs to have `SESSION_` prefix)." + }, + "vpn_name": { + "type": "string", + "maxLength": 32, + "description": "The name of the Message VPN to attempt to join when connecting to an event broker." + }, + "generate_rcv_timestamps": { + "type": "boolean", + "description": "When enabled, a receive timestamp is recorded for each message.", + "default": true + }, + "generate_send_timestamps": { + "type": "boolean", + "description": "When enabled, a send timestamp is automatically included (if not already present) in the Solace-defined fields for each message sent.", + "default": true + }, + "host": { + "type": "string", + "description": "The IPv4 or IPv6 address or host name to connect to (see: https://docs.solace.com/API-Developer-Online-Ref-Documentation/c/index.html#host-entry).", + "x-referenceable": true } }, "required": [ @@ -144,71 +144,44 @@ "message": { "type": "object", "properties": { - "content_encoding": { + "sender_id": { "type": "string", - "description": "Sets the HTTP Content-Encoding applied to the Solace message payload (for example, gzip). If unset, the request Content-Encoding header is used when available." - }, - "functions": { - "type": "array", - "items": { - "type": "string" - }, - "description": "The Lua functions that manipulates (or generates) the message being sent to Solace. The `message` variable can be used to access the current message content, and the function can return a new content." - }, - "user_properties": { - "type": "object", - "properties": { - "predefined_properties": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-lua-required": true - }, - "description": "Predefined user properties to set on every message (key = property name, value = property value)." - }, - "headers": { - "type": "object", - "properties": { - "mappings": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-lua-required": true - }, - "description": "Header-to-user_property mapping (key = HTTP header name, value = target user property name)." - }, - "include_headers": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Headers to include as user properties even without explicit mapping." - }, - "exclude_headers": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Headers that must not be forwarded into user properties. This is used to exclude sensitive headers such as authorization from being forwarded as user properties, or to avoid duplication when a header is mapped to a user property but you don't want the original header to be included as well." - } - }, - "description": "Header settings for user properties (mapping, inclusion and exclusion)." - } - }, - "description": "User defined properties to be included in the message. Separate static properties from header mappings." + "description": "Allows the application to set the content of the sender identifier." }, "ttl": { "type": "integer", "description": "Sets the time to live (TTL) in milliseconds for the message. Setting the time to live to zero disables the TTL for the message.", "default": 0 }, - "default_content": { + "forward_uri": { + "type": "boolean", + "description": "Include the request URI and the URI arguments (as in, query arguments) in the message.", + "default": false + }, + "delivery_mode": { "type": "string", - "description": "When not using `forward_method`, `forward_uri`, `forward_headers`, `forward_body` or `forward_body_raw_only`, this sets the message content." + "enum": [ + "DIRECT", + "PERSISTENT" + ], + "description": "Sets the message delivery mode.", + "default": "DIRECT" }, - "dmq_eligible": { + "priority": { + "type": "integer", + "maximum": 255, + "minimum": 0, + "description": "Sets the message priority.", + "default": 4 + }, + "forward_method": { "type": "boolean", - "description": "Sets the dead message queue (DMQ) eligible property on the message.", + "description": "Include the request method in the message.", + "default": false + }, + "forward_headers": { + "type": "boolean", + "description": "Include the request headers in the message.", "default": false }, "forward_body": { @@ -221,6 +194,27 @@ "description": "Forward only the raw request body without wrapping it in a JSON payload or adding extra fields.", "default": false }, + "ack_timeout": { + "type": "integer", + "maximum": 100000, + "minimum": 1, + "description": "When using a non-DIRECT guaranteed delivery mode, this property sets the message acknowledgement timeout in milliseconds (waiting time).", + "default": 2000 + }, + "tracing": { + "type": "boolean", + "description": "Enable or disable the tracing propagation. This is primarily used for distributed tracing and message correlation, especially in debugging or tracking message flows across multiple systems.", + "default": false + }, + "tracing_sampled": { + "type": "boolean", + "description": "Forcibly turn on the tracing on all the messages for distributed tracing (tracing needs to be enabled as well).", + "default": false + }, + "content_type": { + "type": "string", + "description": "Sets the HTTP Content-Type applied to the Solace message payload. If unset, the request Content-Type header is used when available." + }, "destinations": { "type": "array", "items": { @@ -247,61 +241,67 @@ "minLength": 1, "description": "The message destinations." }, - "delivery_mode": { - "type": "string", - "enum": [ - "DIRECT", - "PERSISTENT" - ], - "description": "Sets the message delivery mode.", - "default": "DIRECT" - }, - "sender_id": { - "type": "string", - "description": "Allows the application to set the content of the sender identifier." - }, - "priority": { - "type": "integer", - "maximum": 255, - "minimum": 0, - "description": "Sets the message priority.", - "default": 4 - }, - "tracing": { - "type": "boolean", - "description": "Enable or disable the tracing propagation. This is primarily used for distributed tracing and message correlation, especially in debugging or tracking message flows across multiple systems.", - "default": false - }, - "tracing_sampled": { - "type": "boolean", - "description": "Forcibly turn on the tracing on all the messages for distributed tracing (tracing needs to be enabled as well).", - "default": false - }, - "forward_method": { + "dmq_eligible": { "type": "boolean", - "description": "Include the request method in the message.", + "description": "Sets the dead message queue (DMQ) eligible property on the message.", "default": false }, - "content_type": { + "default_content": { "type": "string", - "description": "Sets the HTTP Content-Type applied to the Solace message payload. If unset, the request Content-Type header is used when available." + "description": "When not using `forward_method`, `forward_uri`, `forward_headers`, `forward_body` or `forward_body_raw_only`, this sets the message content." }, - "ack_timeout": { - "type": "integer", - "maximum": 100000, - "minimum": 1, - "description": "When using a non-DIRECT guaranteed delivery mode, this property sets the message acknowledgement timeout in milliseconds (waiting time).", - "default": 2000 + "content_encoding": { + "type": "string", + "description": "Sets the HTTP Content-Encoding applied to the Solace message payload (for example, gzip). If unset, the request Content-Encoding header is used when available." }, - "forward_uri": { - "type": "boolean", - "description": "Include the request URI and the URI arguments (as in, query arguments) in the message.", - "default": false + "functions": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The Lua functions that manipulates (or generates) the message being sent to Solace. The `message` variable can be used to access the current message content, and the function can return a new content." }, - "forward_headers": { - "type": "boolean", - "description": "Include the request headers in the message.", - "default": false + "user_properties": { + "type": "object", + "properties": { + "headers": { + "type": "object", + "properties": { + "mappings": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-lua-required": true + }, + "description": "Header-to-user_property mapping (key = HTTP header name, value = target user property name)." + }, + "include_headers": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Headers to include as user properties even without explicit mapping." + }, + "exclude_headers": { + "type": "array", + "items": { + "type": "string" + }, + "description": "Headers that must not be forwarded into user properties. This is used to exclude sensitive headers such as authorization from being forwarded as user properties, or to avoid duplication when a header is mapped to a user property but you don't want the original header to be included as well." + } + }, + "description": "Header settings for user properties (mapping, inclusion and exclusion)." + }, + "predefined_properties": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-lua-required": true + }, + "description": "Predefined user properties to set on every message (key = property name, value = property value)." + } + }, + "description": "User defined properties to be included in the message. Separate static properties from header mappings." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/StandardWebhooks.json b/app/_schemas/ai-gateway/policies/StandardWebhooks.json index 675bd1ea628..9bffdbde5c9 100644 --- a/app/_schemas/ai-gateway/policies/StandardWebhooks.json +++ b/app/_schemas/ai-gateway/policies/StandardWebhooks.json @@ -1,24 +1,5 @@ { "properties": { - "config": { - "type": "object", - "properties": { - "secret_v1": { - "type": "string", - "description": "Webhook secret", - "x-referenceable": true, - "x-encrypted": true - }, - "tolerance_second": { - "type": "integer", - "description": "Tolerance of the webhook timestamp in seconds. If the webhook timestamp is older than this number of seconds, it will be rejected with a '400' response.", - "default": 300 - } - }, - "required": [ - "secret_v1" - ] - }, "protocols": { "type": "array", "items": { @@ -38,6 +19,25 @@ "https" ] }, + "config": { + "type": "object", + "properties": { + "secret_v1": { + "type": "string", + "description": "Webhook secret", + "x-referenceable": true, + "x-encrypted": true + }, + "tolerance_second": { + "type": "integer", + "description": "Tolerance of the webhook timestamp in seconds. If the webhook timestamp is older than this number of seconds, it will be rejected with a '400' response.", + "default": 300 + } + }, + "required": [ + "secret_v1" + ] + }, "consumer_group": { "type": "object", "properties": { diff --git a/app/_schemas/ai-gateway/policies/Statsd.json b/app/_schemas/ai-gateway/policies/Statsd.json index 2cd90b24393..38300223b7b 100644 --- a/app/_schemas/ai-gateway/policies/Statsd.json +++ b/app/_schemas/ai-gateway/policies/Statsd.json @@ -1,15 +1,110 @@ { "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https", + "tcp", + "tls", + "tls_passthrough", + "udp", + "ws", + "wss" + ], + "description": "A string representing a protocol, such as HTTP or HTTPS." + }, + "description": "A set of strings representing protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, "config": { "type": "object", "properties": { - "queue_size": { - "type": "integer" - }, - "prefix": { - "type": "string", - "description": "String to prefix to each metric's name.", - "default": "kong" + "metrics": { + "type": "array", + "items": { + "type": "object", + "properties": { + "consumer_identifier": { + "type": "string", + "enum": [ + "consumer_id", + "custom_id", + "username" + ], + "description": "Authenticated user detail." + }, + "service_identifier": { + "type": "string", + "enum": [ + "service_host", + "service_id", + "service_name", + "service_name_or_host" + ], + "description": "Service detail." + }, + "workspace_identifier": { + "type": "string", + "enum": [ + "workspace_id", + "workspace_name" + ], + "description": "Workspace detail." + }, + "name": { + "type": "string", + "enum": [ + "cache_datastore_hits_total", + "cache_datastore_misses_total", + "kong_latency", + "latency", + "request_count", + "request_per_user", + "request_size", + "response_size", + "shdict_usage", + "status_count", + "status_count_per_user", + "status_count_per_user_per_route", + "status_count_per_workspace", + "unique_users", + "upstream_latency" + ], + "description": "StatsD metric’s name." + }, + "stat_type": { + "type": "string", + "enum": [ + "counter", + "gauge", + "histogram", + "meter", + "set", + "timer" + ], + "description": "Determines what sort of event a metric represents." + }, + "sample_rate": { + "type": "number", + "description": "Sampling rate" + } + }, + "required": [ + "name", + "stat_type" + ] + }, + "description": "List of metrics to be logged." }, "allow_status_codes": { "type": "array", @@ -18,34 +113,26 @@ }, "description": "List of status code ranges that are allowed to be logged in metrics." }, - "use_tcp": { - "type": "boolean", - "default": false + "udp_packet_size": { + "type": "number", + "maximum": 65507, + "minimum": 0, + "default": 0 }, - "consumer_identifier_default": { + "workspace_identifier_default": { "type": "string", "enum": [ - "consumer_id", - "custom_id", - "username" + "workspace_id", + "workspace_name" ], - "default": "custom_id" + "default": "workspace_id" }, - "retry_count": { + "queue_size": { "type": "integer" }, "queue": { "type": "object", "properties": { - "concurrency_limit": { - "type": "integer", - "enum": [ - -1, - 1 - ], - "description": "The number of of queue delivery timers. -1 indicates unlimited.", - "default": 1 - }, "max_batch_size": { "type": "integer", "maximum": 1000000, @@ -89,13 +176,24 @@ "minimum": 0.001, "description": "Maximum time in seconds between retries, caps exponential backoff.", "default": 60 + }, + "concurrency_limit": { + "type": "integer", + "enum": [ + -1, + 1 + ], + "description": "The number of of queue delivery timers. -1 indicates unlimited.", + "default": 1 } } }, - "host": { - "type": "string", - "description": "The IP address or hostname of StatsD server to send data to.", - "default": "localhost" + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "The port of StatsD server to send data to.", + "default": 8125 }, "service_identifier_default": { "type": "string", @@ -107,111 +205,18 @@ ], "default": "service_name_or_host" }, - "flush_timeout": { - "type": "number" - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "The port of StatsD server to send data to.", - "default": 8125 - }, - "metrics": { - "type": "array", - "items": { - "type": "object", - "properties": { - "name": { - "type": "string", - "enum": [ - "cache_datastore_hits_total", - "cache_datastore_misses_total", - "kong_latency", - "latency", - "request_count", - "request_per_user", - "request_size", - "response_size", - "shdict_usage", - "status_count", - "status_count_per_user", - "status_count_per_user_per_route", - "status_count_per_workspace", - "unique_users", - "upstream_latency" - ], - "description": "StatsD metric’s name." - }, - "stat_type": { - "type": "string", - "enum": [ - "counter", - "gauge", - "histogram", - "meter", - "set", - "timer" - ], - "description": "Determines what sort of event a metric represents." - }, - "sample_rate": { - "type": "number", - "description": "Sampling rate" - }, - "consumer_identifier": { - "type": "string", - "enum": [ - "consumer_id", - "custom_id", - "username" - ], - "description": "Authenticated user detail." - }, - "service_identifier": { - "type": "string", - "enum": [ - "service_host", - "service_id", - "service_name", - "service_name_or_host" - ], - "description": "Service detail." - }, - "workspace_identifier": { - "type": "string", - "enum": [ - "workspace_id", - "workspace_name" - ], - "description": "Workspace detail." - } - }, - "required": [ - "name", - "stat_type" - ] - }, - "description": "List of metrics to be logged." - }, - "workspace_identifier_default": { + "prefix": { "type": "string", - "enum": [ - "workspace_id", - "workspace_name" - ], - "default": "workspace_id" - }, - "udp_packet_size": { - "type": "number", - "maximum": 65507, - "minimum": 0, - "default": 0 + "description": "String to prefix to each metric's name.", + "default": "kong" }, - "hostname_in_prefix": { + "use_tcp": { "type": "boolean", "default": false }, + "flush_timeout": { + "type": "number" + }, "tag_style": { "type": "string", "enum": [ @@ -220,36 +225,31 @@ "librato", "signalfx" ] + }, + "host": { + "type": "string", + "description": "The IP address or hostname of StatsD server to send data to.", + "default": "localhost" + }, + "hostname_in_prefix": { + "type": "boolean", + "default": false + }, + "consumer_identifier_default": { + "type": "string", + "enum": [ + "consumer_id", + "custom_id", + "username" + ], + "default": "custom_id" + }, + "retry_count": { + "type": "integer" } } }, - "protocols": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "grpc", - "grpcs", - "http", - "https", - "tcp", - "tls", - "tls_passthrough", - "udp", - "ws", - "wss" - ], - "description": "A string representing a protocol, such as HTTP or HTTPS." - }, - "description": "A set of strings representing protocols.", - "default": [ - "grpc", - "grpcs", - "http", - "https" - ] - }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -257,9 +257,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -267,9 +267,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -277,7 +277,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/StatsdAdvanced.json b/app/_schemas/ai-gateway/policies/StatsdAdvanced.json index 18bbb2f499b..dcbbcf2593e 100644 --- a/app/_schemas/ai-gateway/policies/StatsdAdvanced.json +++ b/app/_schemas/ai-gateway/policies/StatsdAdvanced.json @@ -29,49 +29,45 @@ "config": { "type": "object", "properties": { - "hostname_in_prefix": { - "type": "boolean", - "description": "Include the `hostname` in the `prefix` for each metric name.", - "default": false - }, - "consumer_identifier_default": { - "type": "string", - "enum": [ - "consumer_id", - "custom_id", - "username" - ], - "description": "The default consumer identifier for metrics. This will take effect when a metric's consumer identifier is omitted. Allowed values are `custom_id`, `consumer_id`, `username`.", - "default": "custom_id" - }, - "service_identifier_default": { - "type": "string", - "enum": [ - "service_host", - "service_id", - "service_name", - "service_name_or_host" - ], - "description": "The default service identifier for metrics. This will take effect when a metric's service identifier is omitted. Allowed values are `service_name_or_host`, `service_id`, `service_name`, `service_host`.", - "default": "service_name_or_host" - }, "host": { "type": "string", "description": "A string representing a host name, such as example.com.", "default": "localhost" }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 8125 + "prefix": { + "type": "string", + "description": "String to prefix to each metric's name.", + "default": "kong" }, "metrics": { "type": "array", "items": { "type": "object", "properties": { + "consumer_identifier": { + "type": "string", + "enum": [ + "consumer_id", + "custom_id", + "username" + ] + }, + "service_identifier": { + "type": "string", + "enum": [ + "service_host", + "service_id", + "service_name", + "service_name_or_host" + ] + }, + "workspace_identifier": { + "type": "string", + "enum": [ + "workspace_id", + "workspace_name" + ] + }, "name": { "type": "string", "enum": [ @@ -105,30 +101,6 @@ }, "sample_rate": { "type": "number" - }, - "consumer_identifier": { - "type": "string", - "enum": [ - "consumer_id", - "custom_id", - "username" - ] - }, - "service_identifier": { - "type": "string", - "enum": [ - "service_host", - "service_id", - "service_name", - "service_name_or_host" - ] - }, - "workspace_identifier": { - "type": "string", - "enum": [ - "workspace_id", - "workspace_name" - ] } }, "required": [ @@ -138,18 +110,23 @@ }, "description": "List of Metrics to be logged." }, - "udp_packet_size": { - "type": "number", - "maximum": 65507, - "minimum": 0, - "description": "Combine UDP packet up to the size configured. If zero (0), don't combine the UDP packet. Must be a number between 0 and 65507 (inclusive).", - "default": 0 + "allow_status_codes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "List of status code ranges that are allowed to be logged in metrics." }, "use_tcp": { "type": "boolean", "description": "Use TCP instead of UDP.", "default": false }, + "hostname_in_prefix": { + "type": "boolean", + "description": "Include the `hostname` in the `prefix` for each metric name.", + "default": false + }, "workspace_identifier_default": { "type": "string", "enum": [ @@ -159,32 +136,44 @@ "description": "The default workspace identifier for metrics. This will take effect when a metric's workspace identifier is omitted. Allowed values are `workspace_id`, `workspace_name`. ", "default": "workspace_id" }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 8125 + }, + "udp_packet_size": { + "type": "number", + "maximum": 65507, + "minimum": 0, + "description": "Combine UDP packet up to the size configured. If zero (0), don't combine the UDP packet. Must be a number between 0 and 65507 (inclusive).", + "default": 0 + }, + "consumer_identifier_default": { + "type": "string", + "enum": [ + "consumer_id", + "custom_id", + "username" + ], + "description": "The default consumer identifier for metrics. This will take effect when a metric's consumer identifier is omitted. Allowed values are `custom_id`, `consumer_id`, `username`.", + "default": "custom_id" + }, + "service_identifier_default": { + "type": "string", + "enum": [ + "service_host", + "service_id", + "service_name", + "service_name_or_host" + ], + "description": "The default service identifier for metrics. This will take effect when a metric's service identifier is omitted. Allowed values are `service_name_or_host`, `service_id`, `service_name`, `service_host`.", + "default": "service_name_or_host" + }, "queue": { "type": "object", "properties": { - "initial_retry_delay": { - "type": "number", - "maximum": 1000000, - "minimum": 0.001, - "description": "Time in seconds before the initial retry is made for a failing batch.", - "default": 0.01 - }, - "max_retry_delay": { - "type": "number", - "maximum": 1000000, - "minimum": 0.001, - "description": "Maximum time in seconds between retries, caps exponential backoff.", - "default": 60 - }, - "concurrency_limit": { - "type": "integer", - "enum": [ - -1, - 1 - ], - "description": "The number of of queue delivery timers. -1 indicates unlimited.", - "default": 1 - }, "max_batch_size": { "type": "integer", "maximum": 1000000, @@ -214,20 +203,31 @@ "type": "number", "description": "Time in seconds before the queue gives up calling a failed handler for a batch.", "default": 60 + }, + "initial_retry_delay": { + "type": "number", + "maximum": 1000000, + "minimum": 0.001, + "description": "Time in seconds before the initial retry is made for a failing batch.", + "default": 0.01 + }, + "max_retry_delay": { + "type": "number", + "maximum": 1000000, + "minimum": 0.001, + "description": "Maximum time in seconds between retries, caps exponential backoff.", + "default": 60 + }, + "concurrency_limit": { + "type": "integer", + "enum": [ + -1, + 1 + ], + "description": "The number of of queue delivery timers. -1 indicates unlimited.", + "default": 1 } } - }, - "prefix": { - "type": "string", - "description": "String to prefix to each metric's name.", - "default": "kong" - }, - "allow_status_codes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of status code ranges that are allowed to be logged in metrics." } } }, diff --git a/app/_schemas/ai-gateway/policies/Syslog.json b/app/_schemas/ai-gateway/policies/Syslog.json index d652f64d4ea..36e1c5168e0 100644 --- a/app/_schemas/ai-gateway/policies/Syslog.json +++ b/app/_schemas/ai-gateway/policies/Syslog.json @@ -29,6 +29,34 @@ "config": { "type": "object", "properties": { + "client_errors_severity": { + "type": "string", + "enum": [ + "alert", + "crit", + "debug", + "emerg", + "err", + "info", + "notice", + "warning" + ], + "default": "info" + }, + "server_errors_severity": { + "type": "string", + "enum": [ + "alert", + "crit", + "debug", + "emerg", + "err", + "info", + "notice", + "warning" + ], + "default": "info" + }, "custom_fields_by_lua": { "type": "object", "additionalProperties": { @@ -90,34 +118,6 @@ "warning" ], "default": "info" - }, - "client_errors_severity": { - "type": "string", - "enum": [ - "alert", - "crit", - "debug", - "emerg", - "err", - "info", - "notice", - "warning" - ], - "default": "info" - }, - "server_errors_severity": { - "type": "string", - "enum": [ - "alert", - "crit", - "debug", - "emerg", - "err", - "info", - "notice", - "warning" - ], - "default": "info" } } }, diff --git a/app/_schemas/ai-gateway/policies/TcpLog.json b/app/_schemas/ai-gateway/policies/TcpLog.json index e76a9ed5227..e38da0ba0cd 100644 --- a/app/_schemas/ai-gateway/policies/TcpLog.json +++ b/app/_schemas/ai-gateway/policies/TcpLog.json @@ -29,26 +29,6 @@ "config": { "type": "object", "properties": { - "tls_sni": { - "type": "string", - "description": "An optional string that defines the SNI (Server Name Indication) hostname to send in the TLS handshake." - }, - "ssl_verify": { - "type": "boolean", - "description": "When using TLS, this option enables verification of the certificate presented by the server.", - "default": true - }, - "custom_fields_by_lua": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "A list of key-value pairs, where the key is the name of a log field and the value is a chunk of Lua code, whose return value sets or replaces the log field value." - }, - "host": { - "type": "string", - "description": "The IP address or host name to send data to." - }, "port": { "type": "integer", "maximum": 65535, @@ -69,6 +49,26 @@ "type": "boolean", "description": "Indicates whether to perform a TLS handshake against the remote server.", "default": false + }, + "tls_sni": { + "type": "string", + "description": "An optional string that defines the SNI (Server Name Indication) hostname to send in the TLS handshake." + }, + "ssl_verify": { + "type": "boolean", + "description": "When using TLS, this option enables verification of the certificate presented by the server.", + "default": true + }, + "custom_fields_by_lua": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "A list of key-value pairs, where the key is the name of a log field and the value is a chunk of Lua code, whose return value sets or replaces the log field value." + }, + "host": { + "type": "string", + "description": "The IP address or host name to send data to." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/TlsHandshakeModifier.json b/app/_schemas/ai-gateway/policies/TlsHandshakeModifier.json index 816e0273aa6..df90048f3ad 100644 --- a/app/_schemas/ai-gateway/policies/TlsHandshakeModifier.json +++ b/app/_schemas/ai-gateway/policies/TlsHandshakeModifier.json @@ -29,7 +29,7 @@ } } }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -37,9 +37,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -47,7 +47,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/TlsMetadataHeaders.json b/app/_schemas/ai-gateway/policies/TlsMetadataHeaders.json index 9d5e52504d0..8e495de7525 100644 --- a/app/_schemas/ai-gateway/policies/TlsMetadataHeaders.json +++ b/app/_schemas/ai-gateway/policies/TlsMetadataHeaders.json @@ -19,11 +19,6 @@ "config": { "type": "object", "properties": { - "client_cert_fingerprint_header_name": { - "type": "string", - "description": "Define the HTTP header name used for the SHA1 fingerprint of the client certificate.", - "default": "X-Client-Cert-Fingerprint" - }, "inject_client_cert_details": { "type": "boolean", "description": "Enables TLS client certificate metadata values to be injected into HTTP headers.", @@ -48,6 +43,11 @@ "type": "string", "description": "Define the HTTP header name used for the subject DN of the client certificate.", "default": "X-Client-Cert-Subject-DN" + }, + "client_cert_fingerprint_header_name": { + "type": "string", + "description": "Define the HTTP header name used for the SHA1 fingerprint of the client certificate.", + "default": "X-Client-Cert-Fingerprint" } } }, diff --git a/app/_schemas/ai-gateway/policies/TokenVaultExchange.json b/app/_schemas/ai-gateway/policies/TokenVaultExchange.json new file mode 100644 index 00000000000..5e29916cf01 --- /dev/null +++ b/app/_schemas/ai-gateway/policies/TokenVaultExchange.json @@ -0,0 +1,423 @@ +{ + "properties": { + "protocols": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "description": "A set of strings representing HTTP protocols.", + "default": [ + "grpc", + "grpcs", + "http", + "https" + ] + }, + "config": { + "type": "object", + "properties": { + "subject_token_type": { + "type": "string", + "enum": [ + "access_token", + "api_key" + ], + "description": "Which kind of bearer token the caller presents, sent to the vault as the RFC 8693 subject_token_type. When unset, resolved from the request where provable; else inferred from the token's shape: a JWS is an access_token, anything else an api_key." + }, + "storage": { + "type": "object", + "properties": { + "backend": { + "type": "string", + "enum": [ + "konnect" + ], + "description": "'konnect': the encrypted credential blob lives in Kong Identity, no gateway-side store.", + "default": "konnect" + }, + "current_version": { + "type": "string", + "description": "The version of the key in `keys` used to seal new credential envelopes. Rotation: add the new key under a new version, then point current_version at it -- older versions keep decrypting credentials sealed under them." + }, + "keys": { + "type": "array", + "items": { + "type": "object", + "properties": { + "version": { + "type": "string", + "description": "Unique identifier of this key version, referenced by current_version." + }, + "key": { + "type": "string", + "description": "PEM-encoded private key (EC or RSA) of this version of the gateway's credential key pair. Credentials are envelope-encrypted (per-credential DEK, A256GCM; the DEK is wrapped to the matching public key), so only this gateway can decrypt them.", + "x-referenceable": true, + "x-encrypted": true + } + }, + "required": [ + "key", + "version" + ] + }, + "description": "Versions of the gateway's credential key pair. Only the version named by current_version seals new envelopes; every version tried when decrypting." + } + }, + "required": [ + "current_version", + "keys" + ], + "description": "Credential storage strategy. 'konnect' (default) keeps the gateway-hosted credential as an encrypted blob registered with Kong Identity." + }, + "cache": { + "type": "object", + "properties": { + "redis": { + "type": "object", + "properties": { + "cluster_max_redirections": { + "type": "integer", + "description": "Maximum retry attempts for redirection.", + "default": 5 + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1", + "x-referenceable": true + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_role": { + "type": "string", + "enum": [ + "any", + "master", + "slave" + ], + "description": "Sentinel role to use for Redis connections when the `redis` strategy is defined. Defining this value implies using Redis Sentinel." + }, + "username": { + "type": "string", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", + "x-referenceable": true + }, + "database": { + "type": "integer", + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + }, + "cluster_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + }, + "ip": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + } + } + }, + "minLength": 1, + "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." + }, + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "ssl_verify": { + "type": "boolean", + "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", + "default": true + }, + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "sentinel_nodes": { + "type": "array", + "items": { + "type": "object", + "properties": { + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379 + }, + "host": { + "type": "string", + "description": "A string representing a host name, such as example.com.", + "default": "127.0.0.1" + } + } + }, + "minLength": 1, + "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "sentinel_username": { + "type": "string", + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true + }, + "cloud_authentication": { + "type": "object", + "properties": { + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_cache_name": { + "type": "string", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_region": { + "type": "string", + "description": "The region of the AWS ElastiCache cluster when `auth_provider` is set to `aws`.", + "x-referenceable": true + }, + "aws_is_serverless": { + "type": "boolean", + "description": "This flag specifies whether the cluster is serverless when auth_provider is set to `aws`.", + "default": true + }, + "aws_secret_access_key": { + "type": "string", + "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_assume_role_arn": { + "type": "string", + "description": "The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.", + "x-referenceable": true, + "x-encrypted": true + }, + "azure_client_id": { + "type": "string", + "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true + }, + "azure_tenant_id": { + "type": "string", + "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", + "x-referenceable": true, + "x-encrypted": true + }, + "auth_provider": { + "type": "string", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "x-referenceable": true + }, + "aws_access_key_id": { + "type": "string", + "description": "AWS Access Key ID to be used for authentication when `auth_provider` is set to `aws`.", + "x-referenceable": true, + "x-encrypted": true + }, + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, + "gcp_service_account_json": { + "type": "string", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", + "x-referenceable": true, + "x-encrypted": true + } + }, + "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." + }, + "keepalive_backlog": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." + } + } + } + }, + "description": "Optional best-effort L2 cache for exchanged credentials. Losing it only costs a re-exchange." + }, + "credential": { + "type": "object", + "properties": { + "inbound": { + "type": "object", + "properties": { + "name": { + "type": "string", + "description": "The name of the header, query parameter, or body field that carries the secret. Defaults to `Authorization` for `location: header`; `access_token` otherwise. Warning: using header names other than `Authorization` or `Proxy-Authorization` may leak secrets as arbitrary headers are not redacted in logs, and is therefore discouraged. " + }, + "prefix": { + "type": "string", + "description": "A string to prepend verbatim to the credential value. Defaults to `Bearer ` (note the trailing space) for `location: header`; no prefix otherwise." + }, + "location": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ], + "description": "Where to parse the inbound secret. If `body`, the body must be of type `application/json` or `application/x-www-form-urlencoded`. Warning: providing secrets in a query string is unsafe and highly discouraged, as the secrets may be retained in logs.", + "default": "header" + } + }, + "description": "Where to read the caller's Kong Identity key / access token, which authorizes access to the Token Vault. If unset, defaults to an `Authorization: Bearer ` header." + }, + "outbound": { + "type": "object", + "properties": { + "location": { + "type": "string", + "enum": [ + "body", + "header", + "query" + ], + "description": "Where to inject the vault-issued credential. If `body`, the body must be of type `application/json` or `application/x-www-form-urlencoded`. If empty, one is written with the existing `Content-Type`, or `application/x-www-form-urlencoded` if absent. If `location` is unset, the placement advertised in the vault header `x-kong-bearer-methods-supported` is honoured, defaulting to `header`. Warning: secrets in a query string are unsafe and highly discouraged, as they may be retained in logs." + }, + "name": { + "type": "string", + "description": "The name of the header, query parameter, or body field that carries the secret. Defaults to `Authorization` for `location: header`; `access_token` otherwise. Warning: using header names other than `Authorization` or `Proxy-Authorization` may leak secrets as arbitrary headers are not redacted in logs, and is therefore discouraged. " + }, + "prefix": { + "type": "string", + "description": "A string to prepend verbatim to the credential value. Defaults to `Bearer ` (note the trailing space) for `location: header`; no prefix otherwise." + } + }, + "description": "Where to inject the vault-issued credential into the proxied request. If unset, defaults to an `Authorization: Bearer ` header. " + } + }, + "description": "Location options for secrets authorizing access to, or retrieved from the Token Vault." + }, + "max_request_body_size": { + "type": "integer", + "description": "max allowed body size allowed to be introspected. 0 means unlimited, but the size of this body will still be limited by Nginx's client_max_body_size.", + "default": 8388608 + }, + "directory": { + "type": "string", + "description": "Directory name segment of the vault token endpoint." + }, + "provider": { + "type": "string", + "description": "Name or UUID of the upstream credential provider registered in the Token Vault directory." + } + }, + "required": [ + "directory", + "provider", + "storage" + ], + "description": "Broker the caller's bearer token for an upstream credential registered with the Kong Token Vault, and inject it into the proxied request (an `Authorization: Bearer` header by default -- see `credential`). Not tied to AI providers: point it at any upstream that accepts a vault-issued credential." + }, + "service": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "additionalProperties": false, + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + }, + "route": { + "type": "object", + "properties": { + "id": { + "type": "string" + } + }, + "additionalProperties": false, + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + } + }, + "required": [ + "config" + ] +} \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/UdpLog.json b/app/_schemas/ai-gateway/policies/UdpLog.json index 4536390003f..07ce33e72f5 100644 --- a/app/_schemas/ai-gateway/policies/UdpLog.json +++ b/app/_schemas/ai-gateway/policies/UdpLog.json @@ -29,6 +29,13 @@ "config": { "type": "object", "properties": { + "custom_fields_by_lua": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "description": "Lua code as a key-value map" + }, "host": { "type": "string", "description": "A string representing a host name, such as example.com." @@ -43,13 +50,6 @@ "type": "number", "description": "An optional timeout in milliseconds when sending data to the upstream server.", "default": 10000 - }, - "custom_fields_by_lua": { - "type": "object", - "additionalProperties": { - "type": "string" - }, - "description": "Lua code as a key-value map" } }, "required": [ @@ -57,7 +57,7 @@ "port" ] }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -65,9 +65,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -75,9 +75,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -85,7 +85,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/UpstreamOauth.json b/app/_schemas/ai-gateway/policies/UpstreamOauth.json index 1fcd51b6ca1..ac9d96dabe4 100644 --- a/app/_schemas/ai-gateway/policies/UpstreamOauth.json +++ b/app/_schemas/ai-gateway/policies/UpstreamOauth.json @@ -25,32 +25,34 @@ "client": { "type": "object", "properties": { - "timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Network I/O timeout for requests to the IdP in milliseconds.", - "default": 10000 - }, - "keep_alive": { - "type": "boolean", - "description": "Whether to use keepalive connections to the IdP.", - "default": true - }, - "client_secret_jwt_alg": { + "auth_method": { "type": "string", "enum": [ - "HS256", - "HS512" + "client_secret_basic", + "client_secret_jwt", + "client_secret_post", + "none" ], - "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", - "default": "HS512" + "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", + "default": "client_secret_post" }, "http_version": { "type": "number", "description": "The HTTP version used for requests made by this policy. Supported values: `1.1` for HTTP 1.1 and `1.0` for HTTP 1.0.", "default": 1.1 }, + "http_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." + }, + "https_proxy": { + "type": "string", + "description": "The proxy to use when making HTTPS requests to the IdP." + }, + "https_proxy_authorization": { + "type": "string", + "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + }, "no_proxy": { "type": "string", "description": "A comma-separated list of hosts that should not be proxied." @@ -60,61 +62,39 @@ "description": "Whether to verify the certificate presented by the IdP when using HTTPS.", "default": true }, - "auth_method": { + "client_secret_jwt_alg": { "type": "string", "enum": [ - "client_secret_basic", - "client_secret_jwt", - "client_secret_post", - "none" + "HS256", + "HS512" ], - "description": "The authentication method used in client requests to the IdP. Supported values are: `client_secret_basic` to send `client_id` and `client_secret` in the `Authorization: Basic` header, `client_secret_post` to send `client_id` and `client_secret` as part of the request body, or `client_secret_jwt` to send a JWT signed with the `client_secret` using the client assertion as part of the body.", - "default": "client_secret_post" + "description": "The algorithm to use with JWT when using `client_secret_jwt` authentication.", + "default": "HS512" }, "http_proxy": { "type": "string", "description": "The proxy to use when making HTTP requests to the IdP." }, - "http_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `http_proxy`." - }, - "https_proxy": { - "type": "string", - "description": "The proxy to use when making HTTPS requests to the IdP." + "timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "Network I/O timeout for requests to the IdP in milliseconds.", + "default": 10000 }, - "https_proxy_authorization": { - "type": "string", - "description": "The `Proxy-Authorization` header value to be used with `https_proxy`." + "keep_alive": { + "type": "boolean", + "description": "Whether to use keepalive connections to the IdP.", + "default": true } } }, "oauth": { "type": "object", "properties": { - "audience": { - "type": "array", - "items": { - "type": "string" - }, - "description": "List of audiences passed to the IdP when obtaining a new token.", - "default": [] - }, - "token_endpoint": { - "type": "string", - "description": "The token endpoint URI." - }, - "token_post_args": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true - }, - "description": "Extra post arguments to be passed in the token endpoint request." - }, - "client_secret": { + "client_id": { "type": "string", - "description": "The client secret for the application registration in the IdP.", + "description": "The client ID for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true }, @@ -124,13 +104,13 @@ "x-referenceable": true, "x-encrypted": true }, - "token_headers": { - "type": "object", - "additionalProperties": { - "type": "string", - "x-referenceable": true + "audience": { + "type": "array", + "items": { + "type": "string" }, - "description": "Extra headers to be passed in the token endpoint request." + "description": "List of audiences passed to the IdP when obtaining a new token.", + "default": [] }, "grant_type": { "type": "string", @@ -141,9 +121,9 @@ "description": "The OAuth grant type to be used.", "default": "client_credentials" }, - "client_id": { + "client_secret": { "type": "string", - "description": "The client ID for the application registration in the IdP.", + "description": "The client secret for the application registration in the IdP.", "x-referenceable": true, "x-encrypted": true }, @@ -162,6 +142,26 @@ "default": [ "openid" ] + }, + "token_endpoint": { + "type": "string", + "description": "The token endpoint URI." + }, + "token_headers": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra headers to be passed in the token endpoint request." + }, + "token_post_args": { + "type": "object", + "additionalProperties": { + "type": "string", + "x-referenceable": true + }, + "description": "Extra post arguments to be passed in the token endpoint request." } }, "required": [ @@ -171,6 +171,15 @@ "cache": { "type": "object", "properties": { + "strategy": { + "type": "string", + "enum": [ + "memory", + "redis" + ], + "description": "The method Kong should use to cache tokens issued by the IdP.", + "default": "memory" + }, "memory": { "type": "object", "properties": { @@ -198,30 +207,46 @@ "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", "default": 2000 }, - "password": { + "sentinel_username": { "type": "string", - "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", - "x-referenceable": true, - "x-encrypted": true + "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", + "x-referenceable": true }, "cloud_authentication": { "type": "object", "properties": { + "aws_role_session_name": { + "type": "string", + "description": "The session name for the temporary credentials when assuming the IAM role.", + "x-referenceable": true, + "x-encrypted": true + }, "azure_client_id": { "type": "string", "description": "Azure Client ID to be used for authentication when `auth_provider` is set to `azure`.", "x-referenceable": true, "x-encrypted": true }, + "azure_client_secret": { + "type": "string", + "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "x-encrypted": true, + "x-referenceable": true + }, "azure_tenant_id": { "type": "string", "description": "Azure Tenant ID to be used for authentication when `auth_provider` is set to `azure`.", - "x-referenceable": true, - "x-encrypted": true + "x-encrypted": true, + "x-referenceable": true }, - "aws_cache_name": { + "auth_provider": { "type": "string", - "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", + "enum": [ + "aws", + "azure", + "gcp" + ], + "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", "x-referenceable": true }, "aws_region": { @@ -240,26 +265,15 @@ "x-referenceable": true, "x-encrypted": true }, - "aws_role_session_name": { - "type": "string", - "description": "The session name for the temporary credentials when assuming the IAM role.", - "x-referenceable": true, - "x-encrypted": true - }, - "azure_client_secret": { + "gcp_service_account_json": { "type": "string", - "description": "Azure Client Secret to be used for authentication when `auth_provider` is set to `azure`.", + "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", "x-referenceable": true, "x-encrypted": true }, - "auth_provider": { + "aws_cache_name": { "type": "string", - "enum": [ - "aws", - "azure", - "gcp" - ], - "description": "Auth providers to be used to authenticate to a Cloud Provider's Redis instance.", + "description": "The name of the AWS Elasticache cluster when `auth_provider` is set to `aws`.", "x-referenceable": true }, "aws_access_key_id": { @@ -273,27 +287,44 @@ "description": "AWS Secret Access Key to be used for authentication when `auth_provider` is set to `aws`.", "x-referenceable": true, "x-encrypted": true - }, - "gcp_service_account_json": { - "type": "string", - "description": "GCP Service Account JSON to be used for authentication when `auth_provider` is set to `gcp`.", - "x-referenceable": true, - "x-encrypted": true } }, "description": "Cloud auth related configs for connecting to a Cloud Provider's Redis instance." }, - "database": { + "ssl": { + "type": "boolean", + "description": "If set to true, uses SSL to connect to Redis.", + "default": false + }, + "server_name": { + "type": "string", + "description": "A string representing an SNI (server name indication) value for TLS.", + "x-referenceable": true + }, + "send_timeout": { "type": "integer", - "description": "Database to use for the Redis connection when using the `redis` strategy", - "default": 0 + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 }, - "keepalive_pool_size": { + "password": { + "type": "string", + "description": "Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.", + "x-referenceable": true, + "x-encrypted": true + }, + "sentinel_password": { + "type": "string", + "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", + "x-referenceable": true, + "x-encrypted": true + }, + "keepalive_backlog": { "type": "integer", "maximum": 2147483646, - "minimum": 1, - "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", - "default": 256 + "minimum": 0, + "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." }, "sentinel_nodes": { "type": "array", @@ -317,29 +348,6 @@ "minLength": 1, "description": "Sentinel node addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element." }, - "ssl": { - "type": "boolean", - "description": "If set to true, uses SSL to connect to Redis.", - "default": false - }, - "port": { - "type": "integer", - "maximum": 65535, - "minimum": 0, - "description": "An integer representing a port number between 0 and 65535, inclusive.", - "default": 6379, - "x-referenceable": true - }, - "username": { - "type": "string", - "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", - "x-referenceable": true - }, - "sentinel_username": { - "type": "string", - "description": "Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.", - "x-referenceable": true - }, "ssl_verify": { "type": "boolean", "description": "If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure `lua_ssl_trusted_certificate` in `kong.conf` to specify the CA (or server) certificate used by your Redis server. You may also need to configure `lua_ssl_verify_depth` accordingly.", @@ -350,39 +358,16 @@ "description": "Maximum retry attempts for redirection.", "default": 5 }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "sentinel_password": { - "type": "string", - "description": "Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.", - "x-encrypted": true, - "x-referenceable": true - }, - "connection_is_proxied": { - "type": "boolean", - "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", - "default": false - }, "host": { "type": "string", "description": "A string representing a host name, such as example.com.", "default": "127.0.0.1", "x-referenceable": true }, - "keepalive_backlog": { + "database": { "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return `nil`. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than `keepalive_pool_size`. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than `keepalive_pool_size`." - }, - "sentinel_master": { - "type": "string", - "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." + "description": "Database to use for the Redis connection when using the `redis` strategy", + "default": 0 }, "sentinel_role": { "type": "string", @@ -415,10 +400,34 @@ "minLength": 1, "description": "Cluster addresses to use for Redis connections when the `redis` strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element." }, - "server_name": { + "connection_is_proxied": { + "type": "boolean", + "description": "If the connection to Redis is proxied (e.g. Envoy), set it `true`. Set the `host` and `port` to point to the proxy address.", + "default": false + }, + "port": { + "type": "integer", + "maximum": 65535, + "minimum": 0, + "description": "An integer representing a port number between 0 and 65535, inclusive.", + "default": 6379, + "x-referenceable": true + }, + "username": { "type": "string", - "description": "A string representing an SNI (server name indication) value for TLS.", + "description": "Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to `default`.", "x-referenceable": true + }, + "keepalive_pool_size": { + "type": "integer", + "maximum": 2147483646, + "minimum": 1, + "description": "The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither `keepalive_pool_size` nor `keepalive_backlog` is specified, no pool is created. If `keepalive_pool_size` isn't specified but `keepalive_backlog` is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.", + "default": 256 + }, + "sentinel_master": { + "type": "string", + "description": "Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel." } } }, @@ -431,15 +440,6 @@ "type": "number", "description": "The lifetime of a token without an explicit `expires_in` value.", "default": 3600 - }, - "strategy": { - "type": "string", - "enum": [ - "memory", - "redis" - ], - "description": "The method Kong should use to cache tokens issued by the IdP.", - "default": "memory" } } }, @@ -492,7 +492,7 @@ "oauth" ] }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -500,9 +500,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "consumer": { + "consumer_group": { "type": "object", "properties": { "id": { @@ -510,9 +510,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" }, - "consumer_group": { + "route": { "type": "object", "properties": { "id": { @@ -520,9 +520,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified consumer group has been authenticated. (Note that some policies can not be restricted to consumers groups this way.). Leave unset for the policy to activate regardless of the authenticated Consumer Groups" + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -530,7 +530,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } }, "required": [ diff --git a/app/_schemas/ai-gateway/policies/VaultAuth.json b/app/_schemas/ai-gateway/policies/VaultAuth.json index 98b5063c620..db495ad7c0a 100644 --- a/app/_schemas/ai-gateway/policies/VaultAuth.json +++ b/app/_schemas/ai-gateway/policies/VaultAuth.json @@ -13,6 +13,11 @@ "config": { "type": "object", "properties": { + "access_token_name": { + "type": "string", + "description": "Describes an array of comma-separated parameter names where the policy looks for an access token. The client must send the access token in one of those key names, and the policy will try to read the credential from a header or the querystring parameter with the same name. The key names can only contain [a-z], [A-Z], [0-9], [_], and [-].", + "default": "access_token" + }, "secret_token_name": { "type": "string", "description": "Describes an array of comma-separated parameter names where the policy looks for a secret token. The client must send the secret in one of those key names, and the policy will try to read the credential from a header or the querystring parameter with the same name. The key names can only contain [a-z], [A-Z], [0-9], [_], and [-].", @@ -46,11 +51,6 @@ "type": "boolean", "description": "A boolean value that indicates whether the policy should run (and try to authenticate) on `OPTIONS` preflight requests. If set to `false`, then `OPTIONS` requests will always be allowed.", "default": true - }, - "access_token_name": { - "type": "string", - "description": "Describes an array of comma-separated parameter names where the policy looks for an access token. The client must send the access token in one of those key names, and the policy will try to read the credential from a header or the querystring parameter with the same name. The key names can only contain [a-z], [A-Z], [0-9], [_], and [-].", - "default": "access_token" } } }, diff --git a/app/_schemas/ai-gateway/policies/WebsocketSizeLimit.json b/app/_schemas/ai-gateway/policies/WebsocketSizeLimit.json index 6ebb74f0e85..35dff7362c1 100644 --- a/app/_schemas/ai-gateway/policies/WebsocketSizeLimit.json +++ b/app/_schemas/ai-gateway/policies/WebsocketSizeLimit.json @@ -18,19 +18,19 @@ "config": { "type": "object", "properties": { - "client_max_payload": { + "upstream_max_payload": { "type": "integer", "maximum": 33554432, "minimum": 1 }, - "upstream_max_payload": { + "client_max_payload": { "type": "integer", "maximum": 33554432, "minimum": 1 } } }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -38,9 +38,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -48,9 +48,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -58,7 +58,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/WebsocketValidator.json b/app/_schemas/ai-gateway/policies/WebsocketValidator.json index 3dc47a4961c..5ee27d19579 100644 --- a/app/_schemas/ai-gateway/policies/WebsocketValidator.json +++ b/app/_schemas/ai-gateway/policies/WebsocketValidator.json @@ -66,7 +66,7 @@ "upstream": { "type": "object", "properties": { - "text": { + "binary": { "type": "object", "properties": { "type": { @@ -86,7 +86,7 @@ "type" ] }, - "binary": { + "text": { "type": "object", "properties": { "type": { @@ -110,7 +110,7 @@ } } }, - "route": { + "consumer": { "type": "object", "properties": { "id": { @@ -118,9 +118,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." }, - "service": { + "route": { "type": "object", "properties": { "id": { @@ -128,9 +128,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "consumer": { + "service": { "type": "object", "properties": { "id": { @@ -138,7 +138,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/XmlThreatProtection.json b/app/_schemas/ai-gateway/policies/XmlThreatProtection.json index 8c7ec8a73ae..361541052ce 100644 --- a/app/_schemas/ai-gateway/policies/XmlThreatProtection.json +++ b/app/_schemas/ai-gateway/policies/XmlThreatProtection.json @@ -22,9 +22,9 @@ "config": { "type": "object", "properties": { - "pitarget": { + "namespaceuri": { "type": "integer", - "description": "Maximum size of processing instruction targets.", + "description": "Maximum size of the namespace URI. This value is required if parsing is namespace-aware.", "default": 1024 }, "pidata": { @@ -32,124 +32,124 @@ "description": "Maximum size of processing instruction data.", "default": 1024 }, - "bla_threshold": { + "entityname": { "type": "integer", - "minimum": 1024, - "description": "Sets the threshold after which the protection starts. This protects against the Billion Laughs Attack.", - "default": 8388608 + "description": "Maximum size of entity names in EntityDecl.", + "default": 1024 + }, + "allow_dtd": { + "type": "boolean", + "description": "Indicates whether an XML Document Type Definition (DTD) section is allowed.", + "default": false + }, + "namespace_aware": { + "type": "boolean", + "description": "If not parsing namespace aware, all prefixes and namespace attributes will be counted as regular attributes and element names, and validated as such.", + "default": true }, "max_namespaces": { "type": "integer", "description": "Maximum number of namespaces defined on a tag. This value is required if parsing is namespace-aware.", "default": 20 }, + "document": { + "type": "integer", + "description": "Maximum size of the entire document.", + "default": 10485760 + }, "buffer": { "type": "integer", "description": "Maximum size of the unparsed buffer (see below).", "default": 1048576 }, - "localname": { - "type": "integer", - "description": "Maximum size of the localname. This applies to tags and attributes.", - "default": 1024 - }, - "entityname": { + "comment": { "type": "integer", - "description": "Maximum size of entity names in EntityDecl.", + "description": "Maximum size of comments.", "default": 1024 }, - "entityproperty": { + "localname": { "type": "integer", - "description": "Maximum size of systemId, publicId, or notationName in EntityDecl.", + "description": "Maximum size of the localname. This applies to tags and attributes.", "default": 1024 }, - "allowed_content_types": { - "type": "array", - "items": { - "type": "string" - }, - "description": "A list of Content-Type values with payloads that are allowed, but aren't validated.", - "default": [] - }, - "document": { - "type": "integer", - "description": "Maximum size of the entire document.", - "default": 10485760 - }, - "namespaceuri": { + "attribute": { "type": "integer", - "description": "Maximum size of the namespace URI. This value is required if parsing is namespace-aware.", - "default": 1024 - }, - "checked_content_types": { - "type": "array", - "items": { - "type": "string" - }, - "description": "A list of Content-Type values with payloads that must be validated.", - "default": [ - "application/xml" - ] + "description": "Maximum size of the attribute value.", + "default": 1048576 }, "max_depth": { "type": "integer", "description": "Maximum depth of tags. Child elements such as Text or Comments are not counted as another level.", "default": 50 }, - "max_attributes": { - "type": "integer", - "description": "Maximum number of attributes allowed on a tag, including default ones. Note: If namespace-aware parsing is disabled, then the namespaces definitions are counted as attributes.", - "default": 100 - }, - "attribute": { + "prefix": { "type": "integer", - "description": "Maximum size of the attribute value.", - "default": 1048576 + "description": "Maximum size of the prefix. This applies to tags and attributes. This value is required if parsing is namespace-aware.", + "default": 1024 }, "text": { "type": "integer", "description": "Maximum text inside tags (counted over all adjacent text/CDATA elements combined).", "default": 1048576 }, + "pitarget": { + "type": "integer", + "description": "Maximum size of processing instruction targets.", + "default": 1024 + }, "entity": { "type": "integer", "description": "Maximum size of entity values in EntityDecl.", "default": 1024 }, + "entityproperty": { + "type": "integer", + "description": "Maximum size of systemId, publicId, or notationName in EntityDecl.", + "default": 1024 + }, "bla_max_amplification": { "type": "number", "minimum": 1, "description": "Sets the maximum allowed amplification. This protects against the Billion Laughs Attack.", "default": 100 }, - "allow_dtd": { - "type": "boolean", - "description": "Indicates whether an XML Document Type Definition (DTD) section is allowed.", - "default": false + "checked_content_types": { + "type": "array", + "items": { + "type": "string" + }, + "description": "A list of Content-Type values with payloads that must be validated.", + "default": [ + "application/xml" + ] }, - "namespace_aware": { - "type": "boolean", - "description": "If not parsing namespace aware, all prefixes and namespace attributes will be counted as regular attributes and element names, and validated as such.", - "default": true + "bla_threshold": { + "type": "integer", + "minimum": 1024, + "description": "Sets the threshold after which the protection starts. This protects against the Billion Laughs Attack.", + "default": 8388608 + }, + "allowed_content_types": { + "type": "array", + "items": { + "type": "string" + }, + "description": "A list of Content-Type values with payloads that are allowed, but aren't validated.", + "default": [] }, "max_children": { "type": "integer", "description": "Maximum number of children allowed (Element, Text, Comment, ProcessingInstruction, CDATASection). Note: Adjacent text and CDATA sections are counted as one. For example, text-cdata-text-cdata is one child.", "default": 100 }, - "comment": { - "type": "integer", - "description": "Maximum size of comments.", - "default": 1024 - }, - "prefix": { + "max_attributes": { "type": "integer", - "description": "Maximum size of the prefix. This applies to tags and attributes. This value is required if parsing is namespace-aware.", - "default": 1024 + "description": "Maximum number of attributes allowed on a tag, including default ones. Note: If namespace-aware parsing is disabled, then the namespaces definitions are counted as attributes.", + "default": 100 } } }, - "consumer": { + "route": { "type": "object", "properties": { "id": { @@ -157,9 +157,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." + "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." }, - "route": { + "service": { "type": "object", "properties": { "id": { @@ -167,9 +167,9 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via the specified route. Leave unset for the policy to activate regardless of the route being used." + "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." }, - "service": { + "consumer": { "type": "object", "properties": { "id": { @@ -177,7 +177,7 @@ } }, "additionalProperties": false, - "description": "If set, the policy will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the policy to activate regardless of the Service being matched." + "description": "If set, the policy will activate only for requests where the specified has been authenticated. (Note that some policies can not be restricted to consumers this way.). Leave unset for the policy to activate regardless of the authenticated Consumer." } } } \ No newline at end of file diff --git a/app/_schemas/ai-gateway/policies/Zipkin.json b/app/_schemas/ai-gateway/policies/Zipkin.json index 8eb57c8949c..b9c383acc31 100644 --- a/app/_schemas/ai-gateway/policies/Zipkin.json +++ b/app/_schemas/ai-gateway/policies/Zipkin.json @@ -29,16 +29,169 @@ "config": { "type": "object", "properties": { - "local_service_name": { + "include_credential": { + "type": "boolean", + "description": "Specify whether the credential of the currently authenticated consumer should be included in metadata sent to the Zipkin server.", + "default": true + }, + "header_type": { "type": "string", - "description": "The name of the service as displayed in Zipkin.", - "default": "kong" + "enum": [ + "aws", + "b3", + "b3-single", + "datadog", + "gcp", + "ignore", + "instana", + "jaeger", + "ot", + "preserve", + "w3c" + ], + "description": "All HTTP requests going through the policy are tagged with a tracing HTTP request. This property codifies what kind of tracing header the policy expects on incoming requests", + "default": "preserve" + }, + "http_span_name": { + "type": "string", + "enum": [ + "method", + "method_path" + ], + "description": "Specify whether to include the HTTP path in the span name.", + "default": "method" + }, + "read_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 5000 + }, + "phase_duration_flavor": { + "type": "string", + "enum": [ + "annotations", + "tags" + ], + "description": "Specify whether to include the duration of each phase as an annotation or a tag.", + "default": "annotations" + }, + "default_header_type": { + "type": "string", + "enum": [ + "aws", + "b3", + "b3-single", + "datadog", + "gcp", + "instana", + "jaeger", + "ot", + "w3c" + ], + "description": "Allows specifying the type of header to be added to requests with no pre-existing tracing headers and when `config.header_type` is set to `\"preserve\"`. When `header_type` is set to any other value, `default_header_type` is ignored.", + "default": "b3" + }, + "http_response_header_for_traceid": { + "type": "string" + }, + "queue": { + "type": "object", + "properties": { + "max_bytes": { + "type": "integer", + "description": "Maximum number of bytes that can be waiting on a queue, requires string content." + }, + "max_retry_time": { + "type": "number", + "description": "Time in seconds before the queue gives up calling a failed handler for a batch.", + "default": 60 + }, + "initial_retry_delay": { + "type": "number", + "maximum": 1000000, + "minimum": 0.001, + "description": "Time in seconds before the initial retry is made for a failing batch.", + "default": 0.01 + }, + "max_retry_delay": { + "type": "number", + "maximum": 1000000, + "minimum": 0.001, + "description": "Maximum time in seconds between retries, caps exponential backoff.", + "default": 60 + }, + "concurrency_limit": { + "type": "integer", + "enum": [ + -1, + 1 + ], + "description": "The number of of queue delivery timers. -1 indicates unlimited.", + "default": 1 + }, + "max_batch_size": { + "type": "integer", + "maximum": 1000000, + "minimum": 1, + "description": "Maximum number of entries that can be processed at a time.", + "default": 1 + }, + "max_coalescing_delay": { + "type": "number", + "maximum": 3600, + "minimum": 0, + "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.", + "default": 1 + }, + "max_entries": { + "type": "integer", + "maximum": 1000000, + "minimum": 1, + "description": "Maximum number of entries that can be waiting on the queue.", + "default": 10000 + } + } }, "tags_header": { "type": "string", "description": "The Zipkin policy will add extra headers to the tags associated with any HTTP requests that come with a header named as configured by this property.", "default": "Zipkin-Tags" }, + "static_tags": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "name", + "value" + ] + }, + "description": "The tags specified on this property will be added to the generated request traces." + }, + "connect_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 2000 + }, + "send_timeout": { + "type": "integer", + "maximum": 2147483646, + "minimum": 0, + "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", + "default": 5000 + }, "propagation": { "type": "object", "properties": { @@ -106,14 +259,16 @@ "default_format": "b3" } }, - "http_endpoint": { - "type": "string", - "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." + "sample_ratio": { + "type": "number", + "maximum": 1, + "minimum": 0, + "description": "How often to sample requests that do not contain trace IDs. Set to `0` to turn sampling off, or to `1` to sample **all** requests. ", + "default": 0.001 }, - "include_credential": { - "type": "boolean", - "description": "Specify whether the credential of the currently authenticated consumer should be included in metadata sent to the Zipkin server.", - "default": true + "default_service_name": { + "type": "string", + "description": "Set a default service name to override `unknown-service-name` in the Zipkin spans." }, "traceid_byte_count": { "type": "integer", @@ -124,169 +279,14 @@ "description": "The length in bytes of each request's Trace ID.", "default": 16 }, - "header_type": { - "type": "string", - "enum": [ - "aws", - "b3", - "b3-single", - "datadog", - "gcp", - "ignore", - "instana", - "jaeger", - "ot", - "preserve", - "w3c" - ], - "description": "All HTTP requests going through the policy are tagged with a tracing HTTP request. This property codifies what kind of tracing header the policy expects on incoming requests", - "default": "preserve" - }, - "connect_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 2000 - }, - "send_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 5000 - }, - "default_service_name": { - "type": "string", - "description": "Set a default service name to override `unknown-service-name` in the Zipkin spans." - }, - "default_header_type": { - "type": "string", - "enum": [ - "aws", - "b3", - "b3-single", - "datadog", - "gcp", - "instana", - "jaeger", - "ot", - "w3c" - ], - "description": "Allows specifying the type of header to be added to requests with no pre-existing tracing headers and when `config.header_type` is set to `\"preserve\"`. When `header_type` is set to any other value, `default_header_type` is ignored.", - "default": "b3" - }, - "static_tags": { - "type": "array", - "items": { - "type": "object", - "properties": { - "value": { - "type": "string" - }, - "name": { - "type": "string" - } - }, - "required": [ - "name", - "value" - ] - }, - "description": "The tags specified on this property will be added to the generated request traces." - }, - "read_timeout": { - "type": "integer", - "maximum": 2147483646, - "minimum": 0, - "description": "An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.", - "default": 5000 - }, - "sample_ratio": { - "type": "number", - "maximum": 1, - "minimum": 0, - "description": "How often to sample requests that do not contain trace IDs. Set to `0` to turn sampling off, or to `1` to sample **all** requests. ", - "default": 0.001 - }, - "http_span_name": { + "local_service_name": { "type": "string", - "enum": [ - "method", - "method_path" - ], - "description": "Specify whether to include the HTTP path in the span name.", - "default": "method" - }, - "http_response_header_for_traceid": { - "type": "string" + "description": "The name of the service as displayed in Zipkin.", + "default": "kong" }, - "phase_duration_flavor": { + "http_endpoint": { "type": "string", - "enum": [ - "annotations", - "tags" - ], - "description": "Specify whether to include the duration of each phase as an annotation or a tag.", - "default": "annotations" - }, - "queue": { - "type": "object", - "properties": { - "max_batch_size": { - "type": "integer", - "maximum": 1000000, - "minimum": 1, - "description": "Maximum number of entries that can be processed at a time.", - "default": 1 - }, - "max_coalescing_delay": { - "type": "number", - "maximum": 3600, - "minimum": 0, - "description": "Maximum number of (fractional) seconds to elapse after the first entry was queued before the queue starts calling the handler.", - "default": 1 - }, - "max_entries": { - "type": "integer", - "maximum": 1000000, - "minimum": 1, - "description": "Maximum number of entries that can be waiting on the queue.", - "default": 10000 - }, - "max_bytes": { - "type": "integer", - "description": "Maximum number of bytes that can be waiting on a queue, requires string content." - }, - "max_retry_time": { - "type": "number", - "description": "Time in seconds before the queue gives up calling a failed handler for a batch.", - "default": 60 - }, - "initial_retry_delay": { - "type": "number", - "maximum": 1000000, - "minimum": 0.001, - "description": "Time in seconds before the initial retry is made for a failing batch.", - "default": 0.01 - }, - "max_retry_delay": { - "type": "number", - "maximum": 1000000, - "minimum": 0.001, - "description": "Maximum time in seconds between retries, caps exponential backoff.", - "default": 60 - }, - "concurrency_limit": { - "type": "integer", - "enum": [ - -1, - 1 - ], - "description": "The number of of queue delivery timers. -1 indicates unlimited.", - "default": 1 - } - } + "description": "A string representing a URL, such as https://example.com/path/to/resource?q=search." } } }, diff --git a/app/ai-gateway/ai-audit-log-reference.md b/app/ai-gateway/ai-audit-log-reference.md index 3c5ccac0064..1446939ff75 100644 --- a/app/ai-gateway/ai-audit-log-reference.md +++ b/app/ai-gateway/ai-audit-log-reference.md @@ -49,7 +49,7 @@ Each {{site.ai_gateway}} Policy returns a set of tokens. Log entries include the {{site.ai_gateway}} logs capture detailed information about the request and response payloads, token usage, model details, latency, and cost metrics. They provide a comprehensive view of each AI interaction. {:.warning} -> Logs and metrics for cost and token usage via the [OpenAI Files API](https://developers.openai.com/api/reference/resources/files/methods/list) are not currently supported. +> Logs and metrics for cost and token usage via the [OpenAI Files API](https://developers.openai.com/api/reference/resources/files/methods/list) aren't supported. {% table %} columns: @@ -83,14 +83,14 @@ rows: - property: "`ai.proxy.usage.input_tokens`" description: | The total number of input tokens (text + image + audio). - Used for non-text requests (e.g., image or audio generation). + Used for non-text requests (for example, image or audio generation). - property: "`ai.proxy.usage.input_tokens_details`" description: | A breakdown of input tokens by modality (`text_tokens`, `image_tokens`, `audio_tokens_count`). - property: "`ai.proxy.usage.output_tokens`" description: | The total number of output tokens (text + audio). - Used for non-text responses (e.g., image or audio generation). + Used for non-text responses (for example, image or audio generation). - property: "`ai.proxy.usage.output_tokens_details`" description: | A breakdown of output tokens by modality (`text_tokens`, `audio_tokens`). @@ -474,7 +474,9 @@ rows: ### AI Prompt Compressor logs -When the [AI Prompt Compressor Policy](/ai-gateway/policies/ai-prompt-compressor/) is enabled, additional logs record token counts before and after compression, compression ratios, and metadata about the compression method and model used. +When the [AI Prompt Compressor Policy](/ai-gateway/policies/ai-prompt-compressor/) is enabled, additional logs record token counts before and after compression, the number of compressed messages, the compression time, and metadata about the compression method and model used. + +The following fields summarize the compression for the whole request: {% table %} columns: @@ -483,21 +485,46 @@ columns: - title: Description key: description rows: + - property: "`ai.compressor.provider`" + description: The compression provider, `kong` or `headroom`. - property: "`ai.compressor.original_token_count`" - description: The original number of tokens before compression. + description: The total number of tokens before compression. - property: "`ai.compressor.compress_token_count`" - description: The number of tokens after compression. + description: The total number of tokens after compression. - property: "`ai.compressor.save_token_count`" + description: The total number of tokens saved by compression (original minus compressed). + - property: "`ai.compressor.compressed_message_count`" + description: The number of compressed messages. + - property: "`ai.compressor.duration`" + description: The time the compressor took, in milliseconds. + - property: "`ai.compressor.compress_type`" + description: The type or method of compression used. Not set when the provider is `headroom`. +{% endtable %} + +The `ai.compressor.compress_items` array holds one entry for each compressed message. The `headroom` provider reports one entry for the whole request. For more information, see [Headroom compressor service](/ai-gateway/policies/ai-prompt-compressor/#headroom-compressor-service) and [Compress agent traffic with Headroom using {{site.operator_product_name}}](/operator/konnect/how-to/ai-gateway-headroom/). + +{% table %} +columns: + - title: Property + key: property + - title: Description + key: description +rows: + - property: "`original_token_count`" + description: The number of tokens before compression. + - property: "`compress_token_count`" + description: The number of tokens after compression. + - property: "`save_token_count`" description: The number of tokens saved by compression (original minus compressed). - - property: "`ai.compressor.compress_value`" + - property: "`compress_value`" description: The compression ratio applied. - - property: "`ai.compressor.compress_type`" + - property: "`compress_type`" description: The type or method of compression used. - - property: "`ai.compressor.compressor_model`" + - property: "`compressor_model`" description: The model used to perform the compression. - - property: "`ai.compressor.msg_id`" + - property: "`msg_id`" description: The identifier of the message that was compressed. - - property: "`ai.compressor.information`" + - property: "`information`" description: A summary or message describing the result of compression. {% endtable %} @@ -740,14 +767,25 @@ The following example shows a structured {{site.ai_gateway}} log entry: } }, "compressor": { + "provider": "kong", "original_token_count": 845, "compress_token_count": 485, "save_token_count": 360, - "compress_value": 0.5, + "compressed_message_count": 1, + "duration": 120, "compress_type": "rate", - "compressor_model": "microsoft/llmlingua-2-bert-base-multilingual-cased-meetingbank", - "msg_id": 1, - "information": "Compression was performed and saved 360 tokens" + "compress_items": [ + { + "original_token_count": 845, + "compress_token_count": 485, + "save_token_count": 360, + "compress_value": 0.5, + "compress_type": "rate", + "compressor_model": "microsoft/llmlingua-2-bert-base-multilingual-cased-meetingbank", + "msg_id": 1, + "information": "Compression was performed and saved 360 tokens" + } + ] }, "sanitizer": { "pii_identified": 3, diff --git a/app/ai-gateway/ai-providers/baseten.md b/app/ai-gateway/ai-providers/baseten.md new file mode 100644 index 00000000000..7644be95a6d --- /dev/null +++ b/app/ai-gateway/ai-providers/baseten.md @@ -0,0 +1,169 @@ +--- +title: "Baseten provider" +layout: reference +content_type: reference +description: Reference for supported capabilities and configuration for the Baseten provider +breadcrumbs: + - /ai-gateway/ + - /ai-gateway/ai-providers/ + +permalink: /ai-gateway/ai-providers/baseten/ + +works_on: + - konnect + +products: + - ai-gateway + +tools: + - konnect-api + - kongctl + +tags: + - ai + +min_version: + ai-gateway: '2.3' + +related_resources: + - text: "{{site.ai_gateway}}" + url: /ai-gateway/ + - text: "{{site.ai_gateway}} Policies" + url: /ai-gateway/policies/ + - text: AI Providers + url: /ai-gateway/ai-providers/ + - text: AI Model Provider entity + url: /ai-gateway/entities/ai-model-provider/ + - text: AI Model entity + url: /ai-gateway/entities/ai-model/ + - text: Baseten Model APIs + url: https://docs.baseten.co/inference/model-apis/overview +--- + + + +{% include md/ai-gateway/v2/providers.md providers=site.data.ai-gateway.v2.providers provider_name="Baseten" %} + +## Configure a {{ provider.name }} provider + +To use {{ provider.name }} with {{site.ai_gateway}}, configure a new [AI Model Provider](/ai-gateway/entities/ai-model-provider/). +You can then route [AI Models](/ai-gateway/entities/ai-model/) to {{ provider.name }} Model APIs or to your own dedicated {{ provider.name }} deployments. + +Create an AI Model Provider entity to store your Baseten API key. +{{ provider.name }} authenticates with an `Authorization` header: + +{% entity_example %} +type: model-provider +data: + display_name: Baseten Production + name: my-baseten-account + type: baseten + config: + auth: + type: basic + headers: + - name: Authorization + value: ${key} +variables: + key: + value: $BASETEN_API_KEY + secret: true + description: "The API key used to connect to Baseten. Include the `Bearer` prefix, for example `Bearer `." +{% endentity_example %} + +The same API key authenticates to both Model APIs and dedicated deployments in your Baseten workspace. +One AI Model Provider can serve both kinds of target. + +## Configure a {{ provider.name }} model + +{{ provider.name }} supports the `generate` capability (chat completions), with and without streaming. +Each [target](/ai-gateway/entities/ai-model/#targets) on the AI Model references the {{ provider.name }} provider and sets `config.type` to `baseten`. +How you set the target `name` and `upstream_url` depends on whether the model runs on {{ provider.name }} Model APIs or on a dedicated deployment. + +Use Model APIs for the shared, hosted models in the {{ provider.name }} model library. +Use a dedicated deployment when you need dedicated GPUs or control over hardware and scaling. + +### Model APIs + +By default, {{site.ai_gateway}} sends requests to {{ provider.name }} Model APIs at `https://inference.baseten.co/v1`. +Set the target `name` to the model's slug, which includes the organization prefix, from the [{{ provider.name }} model library](https://docs.baseten.co/inference/model-apis/overview). +For example, use `deepseek-ai/DeepSeek-V4-Pro-0813` or `openai/gpt-oss-120b`: + +{% entity_example %} +type: model +data: + display_name: DeepSeek V4 Pro on Baseten + name: deepseek-v4-pro + type: model + capabilities: + - generate + config: + route: + paths: + - /baseten + targets: + - name: deepseek-ai/DeepSeek-V4-Pro-0813 + provider: my-baseten-account + config: + type: baseten +{% endentity_example %} + +### Dedicated deployments + +To route to a model you deployed on {{ provider.name }}, set the target `upstream_url` to the deployment's full chat completions endpoint: + +```text +https://model-MODEL_ID.api.baseten.co/environments/ENVIRONMENT/sync/v1/chat/completions +``` +{:.no-copy-code} + +Replace `MODEL_ID` with the model ID from your {{ provider.name }} dashboard. +Replace `ENVIRONMENT` with the deployment environment, for example `production`. +Set the target `name` to the model name your deployment serves. +For engines that take a `--served-model-name` flag, such as vLLM, use that value: + +```yaml +targets: + - name: SERVED_MODEL_NAME + provider: my-baseten-account + config: + type: baseten + upstream_url: https://model-MODEL_ID.api.baseten.co/environments/production/sync/v1/chat/completions +``` + +If your deployment exposes an API that the `generate` capability doesn't cover, use the [passthrough format](/ai-gateway/passthrough/) instead. +Set `formats[].type` to `passthrough` on the AI Model. + +## Reasoning and usage + +{{site.ai_gateway}} applies the following to {{ provider.name }} requests and responses: + +- **Reasoning output:** + {{ provider.name }} models return reasoning text in either `reasoning_content` or `thinking`. + {{site.ai_gateway}} normalizes both to `reasoning`, in non-streaming responses and in streaming deltas. +- **Reasoning effort:** + {{site.ai_gateway}} forwards `reasoning_effort` unchanged. + {{ provider.name }} validates the value against the accepted values of the target model. +- **Cached tokens:** + When {{ provider.name }} reports `usage.prompt_tokens_details.cached_tokens`, {{site.ai_gateway}} includes it in the response, the streaming usage event, and the logs. + +{{ provider.name }} can return the model name in lowercase and without the organization prefix. +For example, a request for `deepseek-ai/DeepSeek-V4-Flash-0731` returns `deepseek-v4-flash-0731`. + + + + diff --git a/app/ai-gateway/ai-providers/bedrock.md b/app/ai-gateway/ai-providers/bedrock.md index 4d81b87ccbb..186a858bba9 100644 --- a/app/ai-gateway/ai-providers/bedrock.md +++ b/app/ai-gateway/ai-providers/bedrock.md @@ -55,9 +55,9 @@ faqs: --- -{% include md/ai-gateway/v2/providers.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon Bedrock" %} +{% include md/ai-gateway/v2/providers.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon Bedrock" compare_provider_name="Amazon Bedrock Mantle" variant_label="Bedrock Runtime" compare_variant_label="Bedrock Mantle" %} -{% include md/ai-gateway/v2/native-routes.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon Bedrock" %} +{% include md/ai-gateway/v2/native-routes.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon Bedrock" compare_provider_name="Amazon Bedrock Mantle" variant_label="Bedrock Runtime" compare_variant_label="Bedrock Mantle" %} ## Configure {{ provider.name }} @@ -96,3 +96,103 @@ You can also use {{ provider.name }} with AWS credentials by setting `auth` to ` * **`role_session_name`** (optional): Session name for the assumed role. Required if `assume_role_arn` is set. * **`sts_endpoint_url`** (optional): Custom STS endpoint for role assumption. Defaults to `https://sts.amazonaws.com`. * **`batch_role_arn`** (optional): Separate role ARN for Bedrock batch API calls. + +## Authentication with an Amazon Bedrock API key + +To authenticate with an Amazon Bedrock API key instead of AWS credentials, set `config.auth.type` to `basic` with an `Authorization` header whose value is `Bearer BEDROCK_API_KEY`. +Replace `BEDROCK_API_KEY` with your Amazon Bedrock API key. + +Both authentication methods work with the `runtime` and `mantle` endpoints. + +## Choose a Bedrock endpoint + +{{site.ai_gateway}} can send requests to either of the two Amazon Bedrock inference endpoints, Runtime (the default) or Mantle, depending on the `endpoint_type` in the target `config` of an [AI Model](/ai-gateway/entities/ai-model/). +Use `mantle` when your clients already send OpenAI or Anthropic API requests and you want Bedrock Mantle to handle them natively, for example, to run the OpenAI Codex CLI against models on Bedrock. +Keep `runtime` for Bedrock-native clients, for the Bedrock-specific APIs such as Rerank, async invoke, and batch, and for any model that doesn't support Mantle. + +Mantle supports only chat and Responses requests, in the `openai` or `anthropic` format. For embeddings, the `bedrock` format, and Bedrock-specific APIs such as Rerank, async invoke, and batch, use `runtime`. + +For Anthropic requests, {{site.ai_gateway}} sets the `anthropic-version` header to `2023-06-01` unless the client sends one. It also sets `max_tokens` to `1024` when neither the client nor the model options set it. +If you set `upstream_url` on a Mantle target, {{site.ai_gateway}} keeps that URL's path. + +{% comment %} +TODO(reviewer, AI-123): Confirm the exact AI Model format and capability combination that maps to Responses +(for example, `openai` + `agentic`). +{% endcomment %} + +The following AI Model sends OpenAI Chat Completions requests to Bedrock Mantle: + +{% entity_example %} +type: model +data: + name: my-mantle-model + display_name: My Mantle model + type: model + formats: + - type: openai + capabilities: + - generate + targets: + - name: ${model_id} + provider: my-aws-account + config: + type: bedrock + region: us-east-1 + endpoint_type: mantle +variables: + model_id: + value: $MANTLE_MODEL_ID + description: The ID of a model that Amazon Bedrock serves through the Mantle endpoint in your region. +{% endentity_example %} + +For a complete walkthrough, see [Route OpenAI traffic to Amazon Bedrock Mantle](/ai-gateway/route-openai-traffic-to-bedrock-mantle/). + +## Connect through a VPC endpoint + +To connect to Amazon Bedrock through a VPC endpoint over AWS PrivateLink, set `vpc_endpoint` in the target `config` to the hostname of your interface VPC endpoint. +{{site.ai_gateway}} then sends requests to that host. +The rest of the request behaves as it does with the public endpoint: + +* {{site.ai_gateway}} still builds the Bedrock path for each operation, including streaming (`invoke-with-response-stream`) and async invoke. +* SigV4 signs requests for the Bedrock service and the configured `region`, not for the VPC endpoint hostname. +* If the VPC endpoint is unreachable, the request fails. + {{site.ai_gateway}} doesn't fall back to the public endpoint. + +`vpc_endpoint` is available on chat and invoke targets and on the embeddings model configuration in [`config.balancer.embeddings`](/ai-gateway/entities/ai-model/#schema-aigateway-model-config-balancer-embeddings). + +{% entity_example %} +type: model +data: + name: my-private-bedrock-model + display_name: My private Bedrock model + type: model + formats: + - type: openai + capabilities: + - generate + targets: + - name: us.anthropic.claude-haiku-4-5-20251001-v1:0 + provider: my-aws-account + config: + type: bedrock + region: us-east-1 + vpc_endpoint: ${vpc_endpoint} +variables: + vpc_endpoint: + value: $BEDROCK_VPC_ENDPOINT + description: "The DNS name of your Bedrock Runtime interface VPC endpoint, for example `vpce-0123456789abcdef0-abcdefgh.bedrock-runtime.us-east-1.vpce.amazonaws.com`." +{% endentity_example %} + +`vpc_endpoint` overrides only the host. +If you also set `upstream_url` on the same target, `upstream_url` takes precedence and {{site.ai_gateway}} ignores `vpc_endpoint`. +Use `upstream_url` only when you need to override the full URL, because it also replaces the path that {{site.ai_gateway}} builds for each Bedrock operation. + +{% comment %} +TODO(reviewer, AI-125): +- Q1: If `vpc_endpoint` and `upstream_url` are both set, is that a validation error instead of `upstream_url` winning? Update this paragraph if so. +- Confirm the accepted value format: bare hostname (OpenAPI description) or URL with scheme (Aha says "same rules as `aws_sts_endpoint_url`"). +- Confirm whether `vpc_endpoint` also applies when `endpoint_type: mantle` (a Mantle PrivateLink endpoint), or only to Runtime. +- Confirm that serverless and Dedicated Cloud Gateways can't use this (PrivateLink reachability), or document how they can. +{% endcomment %} + +For a complete walkthrough, see [Connect to Amazon Bedrock through a VPC endpoint](/ai-gateway/connect-to-bedrock-through-vpc-endpoint/). diff --git a/app/ai-gateway/ai-providers/gemini.md b/app/ai-gateway/ai-providers/gemini.md index e8341beb89c..3b875bb4bc1 100644 --- a/app/ai-gateway/ai-providers/gemini.md +++ b/app/ai-gateway/ai-providers/gemini.md @@ -86,7 +86,9 @@ variables: ### Gemini Enterprise -Gemini Enterprise requires GCP credentials instead of an API key. The provider only handles authentication; `auth.type: gcp` by itself doesn't select Gemini Enterprise, since Gemini Standard can use the same GCP auth. What actually routes to Gemini Enterprise is `config.gcp_environment` on the AI Model's target that attaches to this provider. +Gemini Enterprise requires GCP credentials instead of an API key. In {{site.ai_gateway}} 2.2 or earlier, the provider only handles authentication; `auth.type: gcp` by itself doesn't select Gemini Enterprise, since Gemini Standard can use the same GCP auth. What actually routes to Gemini Enterprise is `config.gcp_environment` on the AI Model's target that attaches to this provider. + +`auth.type: gcp` also [selects Gemini Enterprise](#select-gemini-standard-or-gemini-enterprise) when the request path doesn't identify a variant. Create the provider to store your GCP credentials: @@ -137,8 +139,38 @@ ai_gateway_models: policies: [] {% endentity_examples %} -{:.info} -> `targets[].config.gcp_environment` requires `api_endpoint`, `location_id`, and `project_id` together. Without it, this same provider would route to Gemini Standard instead. +`targets[].config.gcp_environment` requires `location_id` and `project_id`. `api_endpoint` is optional. When it's unset, {{site.ai_gateway}} derives the Vertex AI hostname from `location_id`: + +{% table %} +columns: + - title: "`location_id`" + key: location + - title: Derived `api_endpoint` + key: endpoint +rows: + - location: "`global`" + endpoint: "`aiplatform.googleapis.com`" + - location: "Any other value, for example `us-east5`" + endpoint: "`{location_id}-aiplatform.googleapis.com`, for example `us-east5-aiplatform.googleapis.com`" +{% endtable %} + +Set `api_endpoint` explicitly to use a different hostname, such as a Private Service Connect endpoint. An explicit value always takes precedence over the derived one. +In {{site.ai_gateway}} 2.2 and earlier, `api_endpoint` is required. + + + + +## Select Gemini Standard or Gemini Enterprise + +Gemini Standard and Gemini Enterprise use the same `gemini` provider type. +{{site.ai_gateway}} selects the variant for each request by checking the following, in order: + +1. Existing configurations that set `config.gcp_environment` on the target keep routing to Gemini Enterprise. +1. **Inbound request path.** A Vertex AI path that contains `projects/{project_id}/locations/{location}` routes to Gemini Enterprise. A Gemini API path, such as `/v1beta/models/{model_name}:generateContent`, routes to Gemini Standard. +1. **Credential type.** If the path doesn't identify a variant, an API key routes to Gemini Standard, and [GCP service account or OAuth credentials](#authentication-with-gcp-iam) route to Gemini Enterprise. + + + ## Authentication with GCP IAM @@ -158,7 +190,7 @@ Instead of a static service account key, you can configure the GCP provider to o To use Workload Identity Federation, set `auth.type` to `gcp` and add a `workload_identity_federation` object: -* **`source`** (required): The identity provider used to obtain temporary GCP credentials. Currently, only `aws_iam` is supported. +* **`source`** (required): The identity provider used to obtain temporary GCP credentials. Only `aws_iam` is supported. * **`auth_json`** (optional): JSON configuration for the Workload Identity Federation token exchange, Google's `external_account` credential config (audience, token URL, credential source, and optional service account impersonation URL). If not set, Kong falls back to the file path in the `GOOGLE_APPLICATION_CREDENTIALS` environment variable. When `source` is `aws_iam`, provide AWS IAM credentials under `aws` to identify the AWS principal used in the token exchange, or omit them to fall back to the default AWS credentials provider chain (EC2 instance profiles, environment variables, and so on): @@ -210,3 +242,41 @@ variables: value: $AWS_ASSUME_ROLE_ARN description: The ARN of the AWS IAM role to assume for the Workload Identity Federation token exchange. {% endentity_example %} + +## Thought signatures on the OpenAI-compatible route + +A thought signature is an opaque `thoughtSignature` value that Gemini thinking models attach to response parts. +The model needs the signature on the matching part of the next request to keep reasoning context across multi-turn conversations and function calls. +When an AI Model uses the `openai` format with a Gemini target, {{site.ai_gateway}} captures each `thoughtSignature` from the Gemini response and returns it to the client in the OpenAI-compatible response. +When {{site.ai_gateway}} translates the next request back to Gemini, it re-attaches the signature to the matching part. + +To keep signatures intact, send the assistant message from the previous response back unchanged in the conversation history, including any tool calls. +{{site.ai_gateway}} doesn't inspect or modify signature contents and doesn't log them at default log levels. + + + + +## Gemini Interactions API + +{{site.ai_gateway}} forwards requests for the [Gemini Interactions API](https://ai.google.dev/gemini-api/docs/interactions) to Gemini Standard without translating the request or response body. +{{site.ai_gateway}} still authenticates to Gemini with the credentials in the AI Model Provider, and AI Consumer authentication, rate limiting, and logging apply as they do for other Gemini traffic. + +{{site.ai_gateway}} supports the Interactions API only in the native Gemini format. +It doesn't translate requests to or from the OpenAI or Anthropic formats. + + + + +## Vertex AI predict endpoints + +Gemini Enterprise supports the Vertex AI [`predict` method](https://cloud.google.com/vertex-ai/docs/reference/rest/v1/projects.locations.endpoints/predict) for Model Garden models that you deploy to your own Vertex AI endpoint, such as TranslateGemma. +{{site.ai_gateway}} proxies both forms of the request: + +* Deployed endpoint: `/v1/projects/{project_id}/locations/{location}/endpoints/{endpoint_id}:predict` +* Publisher model: `/v1/projects/{project_id}/locations/{location}/publishers/{publisher}/models/{model_name}:predict` + +{{site.ai_gateway}} forwards the `instances` and `parameters` in the request body to Vertex AI unchanged. +The body must match the input schema of the deployed model. + + + diff --git a/app/ai-gateway/monitor-ai-llm-metrics.md b/app/ai-gateway/monitor-ai-llm-metrics.md index ef02bf47d14..699d4c8b802 100644 --- a/app/ai-gateway/monitor-ai-llm-metrics.md +++ b/app/ai-gateway/monitor-ai-llm-metrics.md @@ -34,6 +34,8 @@ works_on: In addition to LLM usage, {{site.ai_gateway}} can also log MCP server traffic. [MCP logging](/ai-gateway/entities/ai-mcp-server/#logging-and-audits) provides visibility into latency, response sizes, and error rates when AI Policies invoke external MCP tools and servers. +If you use the [AI Prompt Compressor Policy](/ai-gateway/policies/ai-prompt-compressor/), compression results are also reported to Konnect Analytics. See [Prompt compression metrics](/ai-gateway/policies/ai-prompt-compressor/#prompt-compression-metrics) for the available metrics and response headers. + Create a [Prometheus Policy](/ai-gateway/policies/prometheus/) to expose metrics in a [Prometheus](https://prometheus.io/docs/introduction/overview/) exposition format, which can be scraped by a Prometheus server. The [Prometheus Policy](/ai-gateway/policies/prometheus/) records and exposes metrics at the node level. Your Prometheus server will need to discover all Kong nodes via a service discovery mechanism, diff --git a/app/ai-gateway/version-support-policy.md b/app/ai-gateway/version-support-policy.md index 3958c078fde..518c6d2cec0 100644 --- a/app/ai-gateway/version-support-policy.md +++ b/app/ai-gateway/version-support-policy.md @@ -92,6 +92,44 @@ Kong will not provide patches for software covered by this sunset period. If the Kong supports the following versions of {{site.ai_gateway_name}}: {% navtabs "ai-gateway-version" %} + +{% navtab "2.3" %} +{{site.ai_gateway_name}} 2.3 was released on . + +{{site.ai_gateway_name}} 2.3 supports the following deployment targets until , unless otherwise noted by an earlier OS vendor end of life (EOL) date. + + +{% table %} +columns: + - title: OS + key: os + - title: Version + key: version + - title: ARM support + key: arm + - title: FIPS 140-3 + key: fips + - title: EOL + key: eol +rows: + - os: Ubuntu + version: "26.04" + arm: true + fips: true + eol: "" + - os: RHEL + version: "10.x" + arm: true + fips: true + eol: "" + - os: Distroless + version: "N/A" + arm: true + fips: true + eol: "" +{% endtable %} + +{% endnavtab %} {% navtab "2.2 (stable)" %} {{site.ai_gateway_name}} 2.2 was released on 2026-09-30. diff --git a/app/assets/icons/baseten.svg b/app/assets/icons/baseten.svg new file mode 100644 index 00000000000..f86d25aea70 --- /dev/null +++ b/app/assets/icons/baseten.svg @@ -0,0 +1,3 @@ + + + diff --git a/app/observability/explorer.md b/app/observability/explorer.md index 8d77205cb46..69b041a5b76 100644 --- a/app/observability/explorer.md +++ b/app/observability/explorer.md @@ -2,12 +2,13 @@ title: "{{site.observability}} Explorer" content_type: reference layout: reference -description: | - Explorer is an intuitive web-based interface that displays API, LLM, platform, and managed cache usage data gathered by {{site.konnect_short_name}} Analytics. You can use this tool to promptly diagnose performance issues, monitor LLM token consumption and costs, or capture essential usage metrics. +description: | + Explorer is an intuitive web-based interface that displays API, LLM, platform, and managed cache usage data gathered by {{site.konnect_short_name}} Analytics. You can use this tool to promptly diagnose performance issues, monitor LLM token consumption and costs, or capture essential usage metrics. breadcrumbs: - /observability/ products: - gateway + - ai-gateway - observability tags: - analytics @@ -51,11 +52,11 @@ faqs: Charts in {{site.konnect_short_name}} Analytics include interactive options to help you investigate data: - **Hover** over a chart to see a tooltip with exact values. - **Left-click** to pin the tooltip. This lets you scroll through long lists or drag the tooltip to a different spot. - - **Click and drag** across the chart to highlight a time range. When you release, choose one of the following actions: + - **Click and drag** across the chart to highlight a time range. When you release, choose one of the following actions: - **View requests**: Opens **Analytics > API Requests** with a filtered list of matching calls. - **Explore**: Opens Explorer with the same filters and highlighted time window, so you can add group-bys and extra filters. - **Zoom**: Focuses the chart on the selected time range. - + From the chart settings, you can do the following: - Open Explorer with the chart’s current filters and time range, by selecting **Explore**. - Download the chart view by selecting **Export CSV**. The file includes the current filters and time window. @@ -71,11 +72,11 @@ faqs: - q: | When I filter platform usage metrics by dimension, why is environment, team, or region always empty? a: | - You must [label](/konnect-platform/konnect-labels/) and [tag](/gateway/tags/) entities with `env`, `team`, or `region` for these to display. - For example, if you label your control plane with `env:production`, it will display when you select "Environment" from the dimensions filter. + You must [label](/konnect-platform/konnect-labels/) and [tag](/gateway/tags/) entities with `env`, `team`, or `region` for these to display. + For example, if you label your control plane with `env:production`, it will display when you select "Environment" from the dimensions filter. - Keep in mind that you must label sub-entities, they do not inherit labels. - For example, labeling your control plane with `region:us` **will not** label your Gateway Services and Routes with `region:us`, they must be labeled individually. + Keep in mind that you must label sub-entities, they do not inherit labels. + For example, labeling your control plane with `region:us` **will not** label your Gateway Services and Routes with `region:us`, they must be labeled individually. related_resources: - text: "{{site.konnect_short_name}} {{site.observability}}" @@ -93,22 +94,22 @@ The Explorer interface displays API, LLM, platform, and managed cache usage data The Analytics Explorer also lets you save the output as a custom report. -To use this feature, navigate to the [Explorer dashboard](https://cloud.konghq.com/analytics/explorer) and switch between API usage, LLM usage, platform usage, and managed cache usage using the dataset dropdown. +To use this feature, navigate to the [Explorer dashboard](https://cloud.konghq.com/analytics/explorer) and switch between API usage, LLM usage, platform usage, and managed cache usage using the dataset dropdown. Metrics and groupings will dynamically adjust based on the selected dataset. ## Enabling data ingestion -Manage data ingestion from any **Control Plane Dashboard** using the **Advanced Analytics** toggle. +Manage data ingestion from any **Control Plane Dashboard** using the **Advanced Analytics** toggle. This toggle lets you enable or disable data collection for your API traffic per Control Plane. **Modes:** - **On:** Both basic and advanced analytics data is collected, allowing in-depth insights and reporting. -- **Off:** Advanced analytics collection stops, but basic API metrics remain available for API Gateway in {{site.konnect_short_name}}, -and can still be used for custom reports. +- **Off:** Advanced analytics collection stops, but basic API metrics remain available for API Gateway in {{site.konnect_short_name}}, +and can still be used for custom reports. ## Metrics -Traffic metrics provide insight into which of your services are being used and how they are responding. +Traffic metrics provide insight into which of your services are being used and how they are responding. Within a single report, you have the flexibility to choose one or multiple metrics from the same category. {% navtabs "metrics" %} @@ -169,12 +170,12 @@ rows: {% endnavtab %} {% navtab "LLM usage" %} -{{site.observability}} allows you to monitor and optimize your LLM usage by providing detailed insights into objects such as token consumption, costs, and latency. +{{site.observability}} allows you to monitor and optimize your LLM usage by providing detailed insights into objects such as token consumption, costs, and latency. With LLM usage reporting, you can: -* Track token consumption: Monitor the number of tokens processed by the different LLM models you have configured. -* Understand costs: Gain visibility into the costs associated with your LLM providers. +* Track token consumption: Monitor the number of tokens processed by the different LLM models you have configured. +* Understand costs: Gain visibility into the costs associated with your LLM providers. * Measure latency: Analyze the latency involved in processing LLM requests. The following table shows which LLM usage metrics you can view: @@ -242,7 +243,36 @@ rows: - attribute: "Cost Savings" unit: "Cost" description: "Cost savings from cache." + - attribute: "Compression Saved Tokens" + unit: "Count" + description: | + Number of tokens saved by the [AI Prompt Compressor Policy](/ai-gateway/policies/ai-prompt-compressor/#prompt-compression-metrics), summed over the compressed messages. + - attribute: "Compression Original Tokens" + unit: "Count" + description: | + Number of tokens before compression. + - attribute: "Compression Compressed Tokens" + unit: "Count" + description: | + Number of tokens after compression. + - attribute: "Compression Message Count" + unit: "Count" + description: | + Number of compressed messages per request. + - attribute: "Compression Duration" + unit: "Latency" + description: | + Average time the compressor took, in milliseconds. + - attribute: "Compressor Provider" + unit: "String" + description: | + Compression provider that handled the request. Possible values: `kong` or `headroom`. + - attribute: "Compression Type" + unit: "String" + description: | + Compression method used. Possible values: `rate` or `target_token`. Available for the `kong` provider only. {% endtable %} + {% endnavtab %} {% navtab "Platform usage" %} @@ -283,7 +313,7 @@ rows: - metric: "Plugin count" category: "Count" description: | - Number of plugins in your control plane. + Number of plugins in your control plane. These can also be filtered by plugin scope and name. - metric: "Consumer count" category: "Count" @@ -378,7 +408,7 @@ rows: ## System-defined groups -`Empty` is an optional, system-defined group that indicates that API calls don't have an entity like [Consumers](/gateway/entities/consumer/) or [Routes](/gateway/entities/route), selected for grouping. `Empty` allows you to group API calls that don't match specific groupings so you can gain more comprehensive insights. You can filter by `Is Empty` or `Is Not Empty`. +`Empty` is an optional, system-defined group that indicates that API calls don't have an entity like [Consumers](/gateway/entities/consumer/) or [Routes](/gateway/entities/route), selected for grouping. `Empty` allows you to group API calls that don't match specific groupings so you can gain more comprehensive insights. You can filter by `Is Empty` or `Is Not Empty`. Some common use cases for `Empty` include: * Identifying the number of API calls that don't match a Route. @@ -386,17 +416,17 @@ Some common use cases for `Empty` include: ## View platform usage metrics by environment, team, and region -Filtering platform usage metrics in Explorer by environment, teams, and regions will show you information such as how many control planes are in each region or how many Gateway Services belong to each team. +Filtering platform usage metrics in Explorer by environment, teams, and regions will show you information such as how many control planes are in each region or how many Gateway Services belong to each team. This uses the following [labels](/konnect-platform/konnect-labels/) and [tags](/gateway/tags/) to map an entity to a dimension: * `env` * `team` * `region` -For example, if you label your control plane with `env:production`, it will display when you select "Environment" from the dimensions filter. +For example, if you label your control plane with `env:production`, it will display when you select "Environment" from the dimensions filter. {:.warning} -> **Labeling sub-entities:** Keep in mind that you must label sub-entities, they do not inherit labels. +> **Labeling sub-entities:** Keep in mind that you must label sub-entities, they do not inherit labels. > For example, labeling your control plane with `region:us` **will not** label your Gateway Services and Routes with `region:us`, they must be labeled individually. -To filter metrics by environment, team, and region, navigate to **{{site.observability}} > Explorer** in the sidebar. -Filter by an entity and in the dimension filter, select if you want to filter by environment, team, or region. \ No newline at end of file +To filter metrics by environment, team, and region, navigate to **{{site.observability}} > Explorer** in the sidebar. +Filter by an entity and in the dimension filter, select if you want to filter by environment, team, or region. \ No newline at end of file diff --git a/tools/automated-tests/README.md b/tools/automated-tests/README.md index 99e661a9ee3..80cb02b8413 100644 --- a/tools/automated-tests/README.md +++ b/tools/automated-tests/README.md @@ -164,3 +164,4 @@ By default, it will run all the instruction files, but it also supports running | `CONTINUE_ON_ERROR` | Whether to continue running tests after a test fails. | false | null | | `KONNECT_DOMAIN` | Selects the Konnect target for the run (e.g. `konghq.tech` to run against the internal environment). Also builds the site if you pass it to `exe/build`, so the rendered commands and the test run agree. | false | `konghq.com` | | `KONNECT_EVENT_GATEWAY_MIN_VERSION` | Sets the minimum Konnect Event Gateway version that the `get.konghq.com/ai` quickstart script deploys. Passed through to the test container only when set. | false | null | +| `KONNECT_AI_GATEWAY_MIN_VERSION` | Sets the minimum Konnect AI Gateway version that the `get.konghq.com/ai` quickstart script deploys. Passed through to the test container only when set. | false | null | diff --git a/tools/automated-tests/instructions/validations.js b/tools/automated-tests/instructions/validations.js index 4e506d17b7c..e7b3489fc33 100644 --- a/tools/automated-tests/instructions/validations.js +++ b/tools/automated-tests/instructions/validations.js @@ -157,10 +157,14 @@ async function executeRequest( redirect: "manual", }; - if (config.body !== undefined && options.method === "POST") { + const methodWithBody = ["POST", "PUT", "PATCH"].includes( + String(options.method).toUpperCase(), + ); + + if (config.body !== undefined && methodWithBody) { options.body = JSON.stringify(replaceEnvVars(config.body, env)); headers["Content-Type"] = headers["Content-Type"] || "application/json"; - } else if (config.body_file !== undefined && options.method === "POST") { + } else if (config.body_file !== undefined && methodWithBody) { options.body = await readFileContent( container, config.body_file, diff --git a/tools/automated-tests/runtimes.js b/tools/automated-tests/runtimes.js index 158be2eedb2..e889f4ea65a 100644 --- a/tools/automated-tests/runtimes.js +++ b/tools/automated-tests/runtimes.js @@ -10,7 +10,12 @@ const log = debug("tests:setup:runtime"); const __filename = fileURLToPath(import.meta.url); const __dirname = dirname(__filename); -const PASSTHROUGH_VARIABLES = ["KONNECT_DOMAIN", "KONGCTL_DEFAULT_KONNECT_ENVIRONMENT", "KONNECT_EVENT_GATEWAY_MIN_VERSION"]; +const PASSTHROUGH_VARIABLES = [ + "KONNECT_DOMAIN", + "KONGCTL_DEFAULT_KONNECT_ENVIRONMENT", + "KONNECT_EVENT_GATEWAY_MIN_VERSION", + "KONNECT_AI_GATEWAY_MIN_VERSION", +]; async function konnectRegion() { const filePath = path.resolve(__dirname, "../../app/_data/konnect_api_request.yml"); diff --git a/tools/automated-tests/test/runtime-environment.test.js b/tools/automated-tests/test/runtime-environment.test.js index 9f37ad3f937..3d4d3f1ee36 100644 --- a/tools/automated-tests/test/runtime-environment.test.js +++ b/tools/automated-tests/test/runtime-environment.test.js @@ -5,6 +5,7 @@ import { runtimeEnvironment } from "../runtimes.js"; const ENV_KEYS = [ "KONNECT_DOMAIN", "KONGCTL_DEFAULT_KONNECT_ENVIRONMENT", + "KONNECT_AI_GATEWAY_MIN_VERSION", "TESTS_KONNECT_CONTROL_PLANE_URL", ]; @@ -77,3 +78,18 @@ test("an explicit TESTS_KONNECT_CONTROL_PLANE_URL wins over the derived value", } ); }); + +test("KONNECT_AI_GATEWAY_MIN_VERSION passes through with no prefix change", async () => { + await withEnv({ KONNECT_AI_GATEWAY_MIN_VERSION: "2.3" }, async () => { + const environment = await runtimeEnvironment(baseRuntimeConfig()); + assert.equal(environment.KONNECT_AI_GATEWAY_MIN_VERSION, "2.3"); + assert.equal(environment.DECK_KONNECT_AI_GATEWAY_MIN_VERSION, undefined); + }); +}); + +test("an unset KONNECT_AI_GATEWAY_MIN_VERSION leaves the container environment without the key", async () => { + await withEnv({}, async () => { + const environment = await runtimeEnvironment(baseRuntimeConfig()); + assert.equal("KONNECT_AI_GATEWAY_MIN_VERSION" in environment, false); + }); +});