From 02ebdf320649c5c999f1644fb8effd055893173f Mon Sep 17 00:00:00 2001 From: lena-larionova <54370747+lena-larionova@users.noreply.github.com> Date: Wed, 21 Oct 2026 21:01:22 +0000 Subject: [PATCH] Download Plugin Schemas and Metadata for 3.13 --- app/_data/plugins/referenceable_fields/3.13.json | 4 ++++ app/_schemas/gateway/plugins/3.13/Confluent.json | 8 ++++++++ .../gateway/plugins/3.13/ConfluentConsume.json | 16 ++++++++++++++++ app/_schemas/gateway/plugins/3.13/HttpLog.json | 6 ++++-- .../gateway/plugins/3.13/KafkaConsume.json | 16 ++++++++++++++++ app/_schemas/gateway/plugins/3.13/KafkaLog.json | 8 ++++++++ .../gateway/plugins/3.13/KafkaUpstream.json | 8 ++++++++ .../plugins/3.13/KonnectApplicationAuth.json | 4 ++-- .../gateway/plugins/3.13/OpenidConnect.json | 4 ++-- .../gateway/plugins/3.13/Opentelemetry.json | 6 ++++-- 10 files changed, 72 insertions(+), 8 deletions(-) diff --git a/app/_data/plugins/referenceable_fields/3.13.json b/app/_data/plugins/referenceable_fields/3.13.json index ef5e3d5d4d1..5fad035734c 100644 --- a/app/_data/plugins/referenceable_fields/3.13.json +++ b/app/_data/plugins/referenceable_fields/3.13.json @@ -440,6 +440,8 @@ "config.redis.username" ], "http-log": [ + "config.headers", + "config.headers.additionalProperties", "config.http_endpoint" ], "jwt-signer": [ @@ -630,6 +632,8 @@ ], "opentelemetry": [ "config.access_logs_endpoint", + "config.headers", + "config.headers.additionalProperties", "config.logs_endpoint", "config.metrics.endpoint", "config.traces_endpoint" diff --git a/app/_schemas/gateway/plugins/3.13/Confluent.json b/app/_schemas/gateway/plugins/3.13/Confluent.json index 851249b0675..fee90251317 100644 --- a/app/_schemas/gateway/plugins/3.13/Confluent.json +++ b/app/_schemas/gateway/plugins/3.13/Confluent.json @@ -178,6 +178,14 @@ ], "type": "object" }, + "identity_pool_id": { + "description": "The Confluent Cloud OAuth identity pool ID, sent as the `Confluent-Identity-Pool-Id` request header. Optional: if omitted, Confluent Cloud automatically maps an identity pool based on the token's claims.", + "type": "string" + }, + "logical_cluster_id": { + "description": "The Confluent Cloud Schema Registry cluster ID, sent as the `target-sr-cluster` request header. Confluent Cloud requires this when `mode` is 'oauth2'.", + "type": "string" + }, "mode": { "default": "none", "description": "Authentication mode to use with the schema registry.", diff --git a/app/_schemas/gateway/plugins/3.13/ConfluentConsume.json b/app/_schemas/gateway/plugins/3.13/ConfluentConsume.json index 71dd18d8a35..ff167360b9f 100644 --- a/app/_schemas/gateway/plugins/3.13/ConfluentConsume.json +++ b/app/_schemas/gateway/plugins/3.13/ConfluentConsume.json @@ -147,6 +147,14 @@ ], "type": "object" }, + "identity_pool_id": { + "description": "The Confluent Cloud OAuth identity pool ID, sent as the `Confluent-Identity-Pool-Id` request header. Optional: if omitted, Confluent Cloud automatically maps an identity pool based on the token's claims.", + "type": "string" + }, + "logical_cluster_id": { + "description": "The Confluent Cloud Schema Registry cluster ID, sent as the `target-sr-cluster` request header. Confluent Cloud requires this when `mode` is 'oauth2'.", + "type": "string" + }, "mode": { "default": "none", "description": "Authentication mode to use with the schema registry.", @@ -379,6 +387,14 @@ ], "type": "object" }, + "identity_pool_id": { + "description": "The Confluent Cloud OAuth identity pool ID, sent as the `Confluent-Identity-Pool-Id` request header. Optional: if omitted, Confluent Cloud automatically maps an identity pool based on the token's claims.", + "type": "string" + }, + "logical_cluster_id": { + "description": "The Confluent Cloud Schema Registry cluster ID, sent as the `target-sr-cluster` request header. Confluent Cloud requires this when `mode` is 'oauth2'.", + "type": "string" + }, "mode": { "default": "none", "description": "Authentication mode to use with the schema registry.", diff --git a/app/_schemas/gateway/plugins/3.13/HttpLog.json b/app/_schemas/gateway/plugins/3.13/HttpLog.json index 123049aff6e..42f11c3d018 100644 --- a/app/_schemas/gateway/plugins/3.13/HttpLog.json +++ b/app/_schemas/gateway/plugins/3.13/HttpLog.json @@ -24,9 +24,11 @@ }, "headers": { "additionalProperties": { - "type": "string" + "description": "\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).", + "type": "string", + "x-referenceable": true }, - "description": "An optional table of headers included in the HTTP message to the upstream server. Values are indexed by header name, and each header name accepts a single string.", + "description": "An optional table of headers included in the HTTP message to the upstream server. Values are indexed by header name, and each header name accepts a single string. \nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).", "type": "object" }, "http_endpoint": { diff --git a/app/_schemas/gateway/plugins/3.13/KafkaConsume.json b/app/_schemas/gateway/plugins/3.13/KafkaConsume.json index 96001e0fce8..d139072db7b 100644 --- a/app/_schemas/gateway/plugins/3.13/KafkaConsume.json +++ b/app/_schemas/gateway/plugins/3.13/KafkaConsume.json @@ -151,6 +151,14 @@ ], "type": "object" }, + "identity_pool_id": { + "description": "The Confluent Cloud OAuth identity pool ID, sent as the `Confluent-Identity-Pool-Id` request header. Optional: if omitted, Confluent Cloud automatically maps an identity pool based on the token's claims.", + "type": "string" + }, + "logical_cluster_id": { + "description": "The Confluent Cloud Schema Registry cluster ID, sent as the `target-sr-cluster` request header. Confluent Cloud requires this when `mode` is 'oauth2'.", + "type": "string" + }, "mode": { "default": "none", "description": "Authentication mode to use with the schema registry.", @@ -386,6 +394,14 @@ ], "type": "object" }, + "identity_pool_id": { + "description": "The Confluent Cloud OAuth identity pool ID, sent as the `Confluent-Identity-Pool-Id` request header. Optional: if omitted, Confluent Cloud automatically maps an identity pool based on the token's claims.", + "type": "string" + }, + "logical_cluster_id": { + "description": "The Confluent Cloud Schema Registry cluster ID, sent as the `target-sr-cluster` request header. Confluent Cloud requires this when `mode` is 'oauth2'.", + "type": "string" + }, "mode": { "default": "none", "description": "Authentication mode to use with the schema registry.", diff --git a/app/_schemas/gateway/plugins/3.13/KafkaLog.json b/app/_schemas/gateway/plugins/3.13/KafkaLog.json index d2743ada3c9..67cd7f3f726 100644 --- a/app/_schemas/gateway/plugins/3.13/KafkaLog.json +++ b/app/_schemas/gateway/plugins/3.13/KafkaLog.json @@ -163,6 +163,14 @@ ], "type": "object" }, + "identity_pool_id": { + "description": "The Confluent Cloud OAuth identity pool ID, sent as the `Confluent-Identity-Pool-Id` request header. Optional: if omitted, Confluent Cloud automatically maps an identity pool based on the token's claims.", + "type": "string" + }, + "logical_cluster_id": { + "description": "The Confluent Cloud Schema Registry cluster ID, sent as the `target-sr-cluster` request header. Confluent Cloud requires this when `mode` is 'oauth2'.", + "type": "string" + }, "mode": { "default": "none", "description": "Authentication mode to use with the schema registry.", diff --git a/app/_schemas/gateway/plugins/3.13/KafkaUpstream.json b/app/_schemas/gateway/plugins/3.13/KafkaUpstream.json index b7111da1cff..a5837e85fb2 100644 --- a/app/_schemas/gateway/plugins/3.13/KafkaUpstream.json +++ b/app/_schemas/gateway/plugins/3.13/KafkaUpstream.json @@ -191,6 +191,14 @@ ], "type": "object" }, + "identity_pool_id": { + "description": "The Confluent Cloud OAuth identity pool ID, sent as the `Confluent-Identity-Pool-Id` request header. Optional: if omitted, Confluent Cloud automatically maps an identity pool based on the token's claims.", + "type": "string" + }, + "logical_cluster_id": { + "description": "The Confluent Cloud Schema Registry cluster ID, sent as the `target-sr-cluster` request header. Confluent Cloud requires this when `mode` is 'oauth2'.", + "type": "string" + }, "mode": { "default": "none", "description": "Authentication mode to use with the schema registry.", diff --git a/app/_schemas/gateway/plugins/3.13/KonnectApplicationAuth.json b/app/_schemas/gateway/plugins/3.13/KonnectApplicationAuth.json index 8ba4fbd791a..cd632c02447 100644 --- a/app/_schemas/gateway/plugins/3.13/KonnectApplicationAuth.json +++ b/app/_schemas/gateway/plugins/3.13/KonnectApplicationAuth.json @@ -993,7 +993,7 @@ }, "ignore_signature": { "default": [], - "description": "Skip the token signature verification on certain grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.", + "description": "Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.", "items": { "enum": [ "authorization_code", @@ -2205,7 +2205,7 @@ }, "verify_signature": { "default": true, - "description": "Verify signature of tokens.", + "description": "Verify the cryptographic signature of tokens. Disabling this skips verification for every token source, including tokens presented directly by clients (bearer); this is insecure for that path. To trust only tokens fetched from the identity provider for specific grants, use `ignore_signature` instead, which never affects bearer tokens.", "type": "boolean" } }, diff --git a/app/_schemas/gateway/plugins/3.13/OpenidConnect.json b/app/_schemas/gateway/plugins/3.13/OpenidConnect.json index 34ed3d0299d..995419a4b91 100644 --- a/app/_schemas/gateway/plugins/3.13/OpenidConnect.json +++ b/app/_schemas/gateway/plugins/3.13/OpenidConnect.json @@ -925,7 +925,7 @@ }, "ignore_signature": { "default": [], - "description": "Skip the token signature verification on certain grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.", + "description": "Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: - `password`: OAuth password grant - `client_credentials`: OAuth client credentials grant - `authorization_code`: authorization code flow - `refresh_token`: OAuth refresh token grant - `session`: session cookie authentication - `introspection`: OAuth introspection - `userinfo`: OpenID Connect user info endpoint authentication.", "items": { "enum": [ "authorization_code", @@ -2137,7 +2137,7 @@ }, "verify_signature": { "default": true, - "description": "Verify signature of tokens.", + "description": "Verify the cryptographic signature of tokens. Disabling this skips verification for every token source, including tokens presented directly by clients (bearer); this is insecure for that path. To trust only tokens fetched from the identity provider for specific grants, use `ignore_signature` instead, which never affects bearer tokens.", "type": "boolean" } }, diff --git a/app/_schemas/gateway/plugins/3.13/Opentelemetry.json b/app/_schemas/gateway/plugins/3.13/Opentelemetry.json index f67533270a8..702f9c670f8 100644 --- a/app/_schemas/gateway/plugins/3.13/Opentelemetry.json +++ b/app/_schemas/gateway/plugins/3.13/Opentelemetry.json @@ -41,9 +41,11 @@ }, "headers": { "additionalProperties": { - "type": "string" + "description": "\nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).", + "type": "string", + "x-referenceable": true }, - "description": "The custom headers to be added in the HTTP request sent to the OTLP server. This setting is useful for adding the authentication headers (token) for the APM backend.", + "description": "The custom headers to be added in the HTTP request sent to the OTLP server. This setting is useful for adding the authentication headers (token) for the APM backend. \nThis field is [referenceable](/gateway/entities/vault/#how-do-i-reference-secrets-stored-in-a-vault).", "type": "object" }, "http_response_header_for_traceid": {