type: kong-for-kubernetes
label: Kong for Kubernetes
documents:
  - apiVersion: configuration.konghq.com/v1
    kind: KongIngress
    metadata:
      name: get-method
    route:
      methods:
        - get
  - apiVersion: configuration.konghq.com/v1
    kind: KongPlugin
    metadata:
      name: add-openid-connect-g0
    plugin: openid-connect
    config:
      issuer: <keycloak-realm-auth-endpoint>
      client_id:
        - <client-id>
      client_secret:
        - <client-secret>
      auth_methods:
        - authorization_code
        - bearer
        - session
        - refresh_token
      session_cookie_name: cookie-name
      refresh_token_param_name: Offline-Token
      scopes:
        - openid
        - profile
        - email
      upstream_user_info_header: x-userinfo
      upstream_access_token_header: access-token-name
  - apiVersion: configuration.konghq.com/v1
    kind: KongPlugin
    metadata:
      name: add-pre-function-g1
    plugin: pre-function
    config:
      functions:
        - |
          local scheme = kong.request.get_scheme()
          if scheme == "http" then
            local host = kong.request.get_host()
            local query = kong.request.get_path_with_query()
            local url = "https://" .. host ..query
            kong.response.set_header("Location",url)
            return kong.response.exit(302,url)
          end
  - apiVersion: configuration.konghq.com/v1
    kind: KongPlugin
    metadata:
      name: add-aws-lambda-p2
    plugin: aws-lambda
    config:
      aws_key: <iam-lambda-user-accesskey>
      aws_secret: <iam-lambda-user-secretkey>
      aws_region: us-east-1
      function_name: <offline-token-function>
      timeout: 60000
      keepalive: 60000
      port: 443
      forward_request_headers: true
  - apiVersion: configuration.konghq.com/v1
    kind: KongPlugin
    metadata:
      name: add-openid-connect-m3
    plugin: openid-connect
    config:
      issuer: <well-known-config>
      scopes_required:
        - offline_access
  - apiVersion: configuration.konghq.com/v1
    kind: KongPlugin
    metadata:
      name: add-aws-lambda-p4
    plugin: aws-lambda
    config:
      aws_key: <iam-lambda-user-accesskey>
      aws_secret: <iam-lambda-user-secretkey>
      aws_region: us-east-1
      function_name: <user-info-function>
      timeout: 60000
      keepalive: 60000
      port: 443
      forward_request_headers: true
  - apiVersion: configuration.konghq.com/v1
    kind: KongPlugin
    metadata:
      name: add-openid-connect-m5
    plugin: openid-connect
    config:
      issuer: <well-known-config>
      scopes_required:
        - fred_read
  - apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: my-cloud-api-0
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt
        external-dns.alpha.kubernetes.io/hostname: myserver
        konghq.com/strip-path: 'true'
        konghq.com/plugins: add-openid-connect-m3, add-aws-lambda-p2, add-pre-function-g1
        konghq.com/override: get-method
        kubernetes.io/ingress.class: kong
    spec:
      tls:
        - hosts:
            - myserver
          secretName: myserver-tls
      rules:
        - host: myserver
          http:
            paths:
              - backend:
                  serviceName: my-cloud-api-service-0
                  servicePort: 443
                path: /v1/offline-portal
  - apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: my-cloud-api-1
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt
        external-dns.alpha.kubernetes.io/hostname: myserver
        konghq.com/strip-path: 'true'
        konghq.com/plugins: add-openid-connect-m5, add-aws-lambda-p4, add-pre-function-g1
        konghq.com/override: get-method
        kubernetes.io/ingress.class: kong
    spec:
      tls:
        - hosts:
            - myserver
          secretName: myserver-tls
      rules:
        - host: myserver
          http:
            paths:
              - path: /v1/user-info
                backend:
                  serviceName: my-cloud-api-service-0
                  servicePort: 443
warnings: []
