Кастомные плагины Kong на Kubernetes без Docker-образов

kong/plugins/my-plugin/
├── handler.lua    -- Логика плагина (реализация фаз жизненного цикла)
└── schema.lua     -- Схема конфигурации (правила валидации)

local MyPlugin = {
    PRIORITY = 1000,  -- Чем выше число, тем раньше выполняется
    VERSION = "1.0.0",
}

function MyPlugin:access(conf)
    -- 'conf' содержит конфигурацию плагина
    -- 'kong' — глобальный Plugin Development Kit (PDK)
    kong.log.info("My plugin is running!")
    local header_value = kong.request.get_header("X-Custom")
    kong.service.request.set_header("X-Processed", "true")
end

function MyPlugin:header_filter(conf)
    kong.response.set_header("X-Plugin-Version", self.VERSION)
end
return MyPlugin

local typedefs = require "kong.db.schema.typedefs"

return {
    name = "my-plugin",
    fields = {
        { consumer = typedefs.no_consumer },
        {
            config = {
                type = "record",
                fields = {
                    {
                        my_setting = {
                            type = "string",
                            default = "default_value",
                            required = true,
                        },
                    },
                },
            },
        },
    },
}

pre-function:                     1000000
jwt2headers (наш кастомный):      1998
jwt:                              1005
circuit-breaker (наш кастомный):  920
rate-limiting:                    910
post-function:                    -1000

apiVersion: gateway-operator.konghq.com/v1alpha1
kind: KongPluginInstallation
metadata:
  name: jwt2headers
spec:
  image: ghcr.io/your-org/kong-plugins/jwt2headers:1.0.3

local jwt_parser = require "kong.plugins.jwt.jwt_parser"
local cjson = require "cjson"

local Jwt2Headers = {
    PRIORITY = 1998,
    VERSION = "0.0.1",
}

function Jwt2Headers:access(conf)
    local auth_header = kong.request.get_header("Authorization")
    local token = extract_token(auth_header)
    if not auth_header or not token then
        return kong.response.exit(401, { message = "Missing or Invalid Authorization header" })
    end
    local jwt, err = jwt_parser:new(token)
    if err then
        return kong.response.exit(401, { message = "Invalid JWT token" })
    end

   for claim_name, claim_value in pairs(jwt.claims) do
        if should_include_claim(claim_name, conf) then
            local header_name = get_header_name(claim_name, conf)
            kong.service.request.set_header(header_name, stringify_value(claim_value))
        end
    end
end

return Jwt2Headers

config = {
    type = "record",
    fields = {
        { claims_to_include = { type = "array", elements = { type = "string" }, default = { "*" } } },
        { claims_to_exclude = { type = "array", elements = { type = "string" }, default = { "iat", "exp", "jti", "ver", "auth_time" } } },
        { custom_headers = { type = "map", keys = { type = "string" }, values = { type = "string" }, default = {} } },
        { header_prefix = { type = "string", default = "x-", len_min = 1 } },
    },
}

local circuit_breaker_lib = require "lua-circuit-breaker.factory"

/usr/local/share/lua/5.1/lua-circuit-breaker/factory.lua
/usr/local/share/lua/5.1/lua-circuit-breaker/circuit_breaker.lua
...

helm/
├── Chart.yaml              -- Метаданные и версия чарта
├── values.yaml             -- Значения по умолчанию
├── .helmignore             -- Файлы, исключаемые при упаковке
└── templates/
    └── configmap.yaml      -- Шаблон, создающий ConfigMap

apiVersion: v1
appVersion: "1.0"
description: A Helm chart for jwt2headers Kong custom plugin
name: jwt2headers
version: 0.1.0
sources:
  - https://github.com/shambhand/kong-plugins.git

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-configmap
data:
  {{ $currentScope := .}}
  {{ range $path, $_ :=  .Files.Glob  "**.lua" }}
  {{ $path }}: |-
  {{- with $currentScope}}
{{ .Files.Get $path | indent 4}}
  {{- end }}
  {{ end }}

name: jwt2headers-plugin
on:
  push:
    branches: [main]
    paths:
      - 'kong/plugins/jwt2headers/**'
      - '.github/workflows/jwt2headers-plugin-release.yml'
  workflow_dispatch:
    inputs:
      Branch:
        description: 'Branch to Build'
        required: true
        default: 'main'

- name: Compute Semantic Version
  id: compute-version
  run: |
    TAG_PREFIX="jwt2headers-"
    LATEST_TAG=$(git tag --list "${TAG_PREFIX}*" --sort=-v:refname | head -n 1)
    if [ -z "$LATEST_TAG" ]; then
      NEW_VERSION="1.0.0"
    else
      VERSION="${LATEST_TAG#$TAG_PREFIX}"
      MAJOR=$(echo "$VERSION" | cut -d. -f1)
      MINOR=$(echo "$VERSION" | cut -d. -f2)
      PATCH=$(echo "$VERSION" | cut -d. -f3)
      NEW_PATCH=$((PATCH + 1))
      NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
    fi

- name: Copy Lua Files to Helm Chart Directory
  run: |
    find ./kong/plugins/jwt2headers -name '*.lua' -exec cp -prv '{}' "${{ env.helm_chart_dir }}" ";"

- name: Helm Package
  run: helm package ${{ env.helm_chart_dir }} --version ${{ steps.compute-version.outputs.VERSION }}

- name: Helm Push to GHCR
  run: helm push jwt2headers-${{ steps.compute-version.outputs.VERSION }}.tgz oci://ghcr.io/${{ github.repository_owner }}/helm-charts

- name: Push Release Tag
  if: ${{ github.event.inputs.Branch == 'main' }}
  run: |
    git tag -a "${{ steps.compute-version.outputs.TAG_VERSION }}" \
      -m "Release ${{ steps.compute-version.outputs.TAG_VERSION }}"
    git push origin "${{ steps.compute-version.outputs.TAG_VERSION }}"

# Добавляем репозиторий Helm Kong (для самого чарта Kong)
helm repo add kong https://charts.konghq.com
helm repo update

# Создаём namespace
kubectl create namespace kong

# Устанавливаем чарт плагина jwt2headers (простой плагин, без зависимостей)
helm upgrade --install jwt2headers oci://ghcr.io/shambhand/helm-charts/jwt2headers \
  --version 1.0.3 \
  -n kong

# Сначала устанавливаем чарт библиотеки lua-circuit-breaker (зависимость)
helm upgrade --install lua-circuit-breaker oci://ghcr.io/shambhand/helm-charts/lua-circuit-breaker \
  --version 1.0.2 \
  -n kong

# Затем устанавливаем чарт плагина circuit-breaker
helm upgrade --install circuit-breaker oci://ghcr.io/shambhand/helm-charts/circuit-breaker \
  --version 1.0.2 \
  -n kong

$ kubectl get configmaps -n kong
NAME                                DATA
jwt2headers-configmap               2    # handler.lua, schema.lua
circuit-breaker-configmap           3    # handler.lua, schema.lua, helpers.lua
lua-circuit-breaker-configmap       6    # factory.lua, circuit_breaker.lua, ...

$ helm upgrade --install kong kong/kong \
  -f values.yaml \
  -n kong \
  --create-namespace

$ kubectl get pods -n kong
NAME                         READY   STATUS    RESTARTS   AGE
kong-kong-86c7cd455f-wdpct   2/2     Running   0          44m

$ helm list -n kong
NAME                NAMESPACE REVISION UPDATED                              STATUS   CHART                     APP VERSION
circuit-breaker     kong      1        2026-03-17 23:37:26.853931 +0530 IST deployed circuit-breaker-1.0.2     1.0
jwt2headers         kong      1        2026-03-17 23:36:26.858752 +0530 IST deployed jwt2headers-1.0.3         1.0
kong                kong      1        2026-03-17 23:41:41.161226 +0530 IST deployed kong-3.1.0                3.9
lua-circuit-breaker kong      1        2026-03-17 23:37:13.268607 +0530 IST deployed lua-circuit-breaker-1.0.2 1.0

env:
  - name: KONG_PLUGINS
    value: "bundled,jwt2headers,circuit-breaker"

containers:
  - name: proxy
    volumeMounts:
      - name: kong-plugin-jwt2headers
        mountPath: /opt/kong/plugins/jwt2headers
        readOnly: true
      - name: kong-plugin-circuit-breaker
        mountPath: /opt/kong/plugins/circuit-breaker
        readOnly: true
      # Из deployment.userDefinedVolumeMounts
      - name: lua-circuit-breaker-lib
        mountPath: /usr/local/share/lua/5.1/lua-circuit-breaker
        readOnly: true

# Рендерится в спецификации пода деплоя Kong
volumes:
  - name: kong-plugin-jwt2headers
    configMap:
      name: jwt2headers-configmap
  - name: kong-plugin-circuit-breaker
    configMap:
      name: circuit-breaker-configmap
  # Из deployment.userDefinedVolumes
  - name: lua-circuit-breaker-lib
    configMap:
      name: lua-circuit-breaker-configmap

env:
  - name: KONG_LUA_PACKAGE_PATH
    value: "/opt/kong/plugins/?.lua;/opt/kong/plugins/?/init.lua;;"

Установка Helm-чарта плагина
 → Создаётся ConfigMap (Lua-исходники как ключи данных)
   → Helm-чарт Kong ссылается на ConfigMap в values.yaml
     → Чарт Kong рендерит: Volume + VolumeMount + переменная KONG_PLUGINS
       → Контейнер Kong стартует с файлами плагина на диске и зарегистрированными плагинами

curl -X POST https://{KONNECT_REGION}.api.konghq.com/v2/control-planes/{CP_ID}/core-entities/plugin-schemas \
  -H "Authorization: Bearer $KONNECT_TOKEN" \
  -F "name=jwt2headers" \
  -F "lua_schema=@kong/plugins/jwt2headers/schema.lua"