Plugin Compatibility

Introduction

Each Kong Konnect tier gives you access to a subset of plugins:

Konnect can be configured in the following ways:

Kong-hosted cloud: Hybrid deployment. Nodes are split into control plane and data plane roles. Kong provides and hosts the control plane and a database with Konnect Cloud, and you provide the data plane nodes (no databases required).
Self-managed: Use any hosting service of your choice or host on-premises, with any of the following network configurations:
- Classic: Every node is connected to a database. Refers to a classic deployment on any platform, including Kubernetes.
- DB-less: Deployed without a database (available in Kong Gateway (OSS) 1.1 and Kong Gateway 2.4 onward). Admin API is read-only, except for the /config endpoint. Refers to a DB-less deployment on any platform, including Kubernetes.
- Hybrid mode: Nodes are split into control plane and data plane roles. The control plane coordinates configuration and propagates it to data plane nodes, so only control plane nodes require a database (available in Kong Gateway (OSS) 2.0 and Kong Gateway 2.1 onward).

For the differences between deployment types when running on Kubernetes, see Kong Gateway for Kubernetes Deployment Options.

Plugin	Supported network configuration	Notes
Application Registration	All	Cannot be applied directly as a plugin with Konnect Cloud.
Basic Auth	All	--
HMAC Auth	All	--
JWT	All	--
JWT Signer	All	--
Key Auth	All	--
Key Auth Encrypted	All	The time-to-live (ttl) does not work in hybrid mode. This setting determines the length of time a credential remains valid.
LDAP Auth	All	--
LDAP Auth Advanced	All	--
Mutual TLS	All	--
OAuth 2	Self-managed classic only	This plugin can't be used in hybrid or DB-less modes. It needs to generate and delete tokens, and commit those changes to a database on the same node.
OAuth 2 Introspection	All	--
OpenID Connect	All	--
Session	All	--
Vault Auth	Self-managed classic, DB-less, and hybrid	--

Plugin	Supported network configuration	Notes
Acme	All	--
Bot Detection	All	--
CORS	All	--
IP Restriction	All	--
OPA	All	--

Plugin	Supported network configuration	Notes
ACL	All	--
Canary	All	--
Forward Proxy	All	--
GraphQL Proxy Caching Advanced	All	--
GraphQL Rate Limiting Advanced	All	In DB-less and hybrid modes, the `cluster` config strategy is not supported. Use `redis` instead.
Proxy Caching	All	--
Proxy Caching Advanced	All	--
Rate Limiting	All	In DB-less and hybrid modes, the `cluster` config policy is not supported. For DB-less mode, use one of `redis` or `local`; for hybrid mode, use `redis`, or `local` for data planes only.
Rate Limiting Advanced	All	In DB-less and hybrid modes, the `cluster` config strategy is not supported. Use `redis` instead.
Request Size Limiting	All	--
Request Termination	All	--
Request Validator	All	--
Response Rate Limiting	All	In DB-less and hybrid modes, the `cluster` config policy is not supported. For DB-less mode, use one of `redis` or `local`; for hybrid mode, use `redis`, or `local` for data planes only.
Route By Header	All	--
Mocking	All	--

Plugin	Supported network configuration	Notes
AWS Lambda	All	--
Azure Functions	All	--
Serverless Functions	All	--
OpenWhisk	Self-managed classic, DB-less, and hybrid	Not bundled with Kong Gateway. Installed as a LuaRocks package.

Plugin	Supported network configuration	Notes
Datadog	All	--
Prometheus	All	--
Zipkin	All	--

Plugin	Supported network configuration	Notes
Correlation ID	All	--
DeGraphQL	All	--
Exit Transformer	All	--
gRPC Gateway	All	--
gRPC Web	All	--
jq	All	--
Kafka Upstream	All	--
Request Transformer	All	--
Request Transformer Advanced	All	--
Response Transformer	All	--
Response Transformer Advanced	All	--
Route Transformer Advanced	All	--

Plugin	Supported network configuration	Notes
File Log	All	--
HTTP Log	All	--
Kafka Log	All	--
Loggly	All	--
StatsD	All	--
StatsD Advanced	All	--
Syslog	All	--
TCP Log	All	--
UDP Log	All	--

Deployment plugins are not bundled with any version of Konnect, and are simply tools to help you deploy Kong Gateway in various environments.