feat(gateway): Datakit and principals by juliamrch · Pull Request #7099 · Kong/developer.konghq.com

juliamrch · 2026-09-02T18:56:54Z

Description

Preview Links

Testing instructions

Kong Konnect

Run:

export KONNECT_DOMAIN=konghq.tech
curl -Ls https://get.konghq.com/quickstart | bash -s -- -k $KONNECT_TOKEN \
     --deck-output \
     -i kong-gateway-dev -t 3.16.0.0-rc.1

Required entities

echo '
_format_version: "3.0"
services:
  - name: example-service
    url: http://httpbin.konghq.com/anything
routes:
  - name: example-route
    paths:
    - "/anything"
    service:
      name: example-service
    protocols:
    - http
    - https
' | deck gateway apply --konnect-addr $KONNECT_CONTROL_PLANE_URL -

For every decK command, add --konnect-addr $KONNECT_CONTROL_PLANE_URL - at the end of the command.

Checklist

Tested how-to docs. If not, note why here.
All pages contain metadata.
Any new docs link to existing docs.
All autogenerated instructions render correctly (API, decK, Konnect, Kong Manager).
Style guide (capitalized gateway entities, placeholder URLs) implemented correctly.
Every page has a description entry in frontmatter.
Add new pages to the product documentation index (if applicable).

netlify · 2026-09-02T19:03:34Z

✅ Deploy Preview for kongdeveloper ready!

Name	Link
🔨 Latest commit	`b435b4a`
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/6aa18fcdca74af00088e67f2
😎 Deploy Preview	https://deploy-preview-7099--kongdeveloper.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

cloudjumpercat

Left suggestions! Everything seemed to be working until the end validate steps. Things were missing from the response, like display_name, everything was coming from httpbin.konghq.com as host, and the unauthenticated request gave me a 200 instead of being rejected.

cloudjumpercat · 2026-09-10T15:07:34Z

+
+extended_description: |
+  Sign an outgoing JWT in a request header using the authenticated Principal's ID as the subject.
+  This example assumes a Consumer has already been authenticated before Datakit runs.


Suggested change

This example assumes a Consumer has already been authenticated before Datakit runs.

This example assumes a Consumer is already authenticated before Datakit runs.

cloudjumpercat · 2026-09-10T15:33:28Z

+  Sign an outgoing JWT in a request header using the authenticated Principal's ID as the subject.
+
+extended_description: |
+  Sign an outgoing JWT in a request header using the authenticated Principal's ID as the subject.


Suggested change

Sign an outgoing JWT in a request header using the authenticated Principal's ID as the subject.

Sign an outgoing JWT in a request header using the authenticated [Principal's](/identity/principals/) ID as the subject.

cloudjumpercat · 2026-09-10T15:56:03Z

+
+## Create an authorization server in {{site.identity}}
+
+An authorization server in {{site.identity}} issues the OAuth tokens that callers present to authenticate to your service.


Suggested change

An authorization server in {{site.identity}} issues the OAuth tokens that callers present to authenticate to your service.

An [authorization server](/identity/auth-servers/) in {{site.identity}} issues the OAuth tokens that callers present to authenticate to your service.

cloudjumpercat · 2026-09-10T15:56:55Z

+## Create an authorization server in {{site.identity}}
+
+An authorization server in {{site.identity}} issues the OAuth tokens that callers present to authenticate to your service.
+It's recommended that you create different authorization servers for different environments. The authorization server name is unique per each organization and each {{site.konnect_short_name}} region.


Suggested change

It's recommended that you create different authorization servers for different environments. The authorization server name is unique per each organization and each {{site.konnect_short_name}} region.

We recommend that you create different authorization servers for different environments. The authorization server name is unique per each organization and each {{site.konnect_short_name}} region.

cloudjumpercat · 2026-09-10T16:01:19Z

+## Create the clients
+
+Create one client per caller. Each client is the machine-to-machine credential that a caller uses to fetch a token.
+{{site.konnect_short_name}} autogenerates the client ID and secret.


Suggested change

{{site.konnect_short_name}} autogenerates the client ID and secret.

In this example, {{site.konnect_short_name}} autogenerates the client ID and secret, but you can also specify them yourself instead.

feel free to adjust wording, just wanted users to know that autogeneration isn't the only option

cloudjumpercat · 2026-09-10T16:11:29Z

+{% endentity_examples %}
+
+In this configuration:
+* `GET_PRINCIPAL`: Reads the `kong.client.principal` object that the OpenID Connect plugin populates. No input is connected because this is a read-only (get) operation.


Suggested change

* `GET_PRINCIPAL`: Reads the `kong.client.principal` object that the OpenID Connect plugin populates. No input is connected because this is a read-only (get) operation.

* `GET_PRINCIPAL`: Reads the `kong.client.principal` object that the OpenID Connect plugin populates. No input is connected because this is a read-only operation.

cloudjumpercat · 2026-09-10T16:17:17Z

+
+   The response comes from `httpbin.konghq.com`.
+   In the response body, find the `complete` event for each node and check:
+   * `GET_PRINCIPAL`: `value.value.display_name` is `orders-caller`.


I don't see display_name in my output, but I do see the response came from httpbin.konghq.com, so I know it did work.

cloudjumpercat · 2026-09-10T16:19:12Z

+     -H "X-Datakit-Debug-Trace: true"
+   ```
+
+   The response comes from `httpbun.com`, confirming the request was routed to a different backend.


For me, the response for this one was also coming from httpbin.konghq.com.

This was also in my logs: vault.lua:1411 could not retrieve value for reference {vault://env/JWT_HMAC_SECRET} (could not get value from external vault (no value found))

cloudjumpercat · 2026-09-10T16:20:29Z

+
+   {% validation unauthorized-check %}
+   url: /anything
+   {% endvalidation %}


This one gave me a 200.

cloudjumpercat · 2026-09-10T16:21:58Z

+<!--vale on-->
+
+Send a request as `orders-caller` again. Once the OpenID Connect plugin's token cache expires, the response comes from `httpbun.com` with no change to your gateway configuration:
+


This one is still coming from httpbin.konghq.com as well.

juliamrch self-assigned this Sep 2, 2026

juliamrch added product:gateway release-docs Docs for release labels Sep 2, 2026

juliamrch linked an issue Sep 2, 2026 that may be closed by this pull request

[API GW 3.16] Principals in Datakit #6792

Open

juliamrch changed the title ~~add configuration example~~ feat(gateway); Datakit and principals Sep 2, 2026

juliamrch changed the title ~~feat(gateway); Datakit and principals~~ feat(gateway): Datakit and principals Sep 8, 2026

lena-larionova force-pushed the release/gateway-3.16 branch from 0e5d624 to ec08246 Compare September 8, 2026 21:33

juliamrch added 8 commits September 9, 2026 18:56

add configuration example

f2140d3

add principal property

8a497c3

fix: example title

33e6512

fix: version

d65390b

fix: remove callout

6f4ce2d

add principal in the use case table

2752031

how-to

7e3178e

related resources

b435b4a

juliamrch force-pushed the iss6792 branch from 92c2170 to b435b4a Compare September 9, 2026 16:56

juliamrch marked this pull request as ready for review September 9, 2026 16:57

juliamrch requested a review from a team as a code owner September 9, 2026 16:57

cloudjumpercat requested changes Sep 10, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(gateway): Datakit and principals - #7099

feat(gateway): Datakit and principals#7099
juliamrch wants to merge 8 commits into
release/gateway-3.16from
iss6792

juliamrch commented Sep 2, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

cloudjumpercat left a comment

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

cloudjumpercat Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	This example assumes a Consumer has already been authenticated before Datakit runs.
	This example assumes a Consumer is already authenticated before Datakit runs.

	Sign an outgoing JWT in a request header using the authenticated Principal's ID as the subject.
	Sign an outgoing JWT in a request header using the authenticated [Principal's](/identity/principals/) ID as the subject.


		## Create an authorization server in {{site.identity}}

		An authorization server in {{site.identity}} issues the OAuth tokens that callers present to authenticate to your service.

	An authorization server in {{site.identity}} issues the OAuth tokens that callers present to authenticate to your service.
	An [authorization server](/identity/auth-servers/) in {{site.identity}} issues the OAuth tokens that callers present to authenticate to your service.

	It's recommended that you create different authorization servers for different environments. The authorization server name is unique per each organization and each {{site.konnect_short_name}} region.
	We recommend that you create different authorization servers for different environments. The authorization server name is unique per each organization and each {{site.konnect_short_name}} region.

	{{site.konnect_short_name}} autogenerates the client ID and secret.
	In this example, {{site.konnect_short_name}} autogenerates the client ID and secret, but you can also specify them yourself instead.

	* `GET_PRINCIPAL`: Reads the `kong.client.principal` object that the OpenID Connect plugin populates. No input is connected because this is a read-only (get) operation.
	* `GET_PRINCIPAL`: Reads the `kong.client.principal` object that the OpenID Connect plugin populates. No input is connected because this is a read-only operation.

		<!--vale on-->

		Send a request as `orders-caller` again. Once the OpenID Connect plugin's token cache expires, the response comes from `httpbun.com` with no change to your gateway configuration:

Uh oh!

Conversation

juliamrch commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Preview Links

Testing instructions

Kong Konnect

Required entities

Checklist

Uh oh!

netlify Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kongdeveloper ready!

Uh oh!

cloudjumpercat left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

juliamrch commented Sep 2, 2026 •

edited

Loading

netlify Bot commented Sep 2, 2026 •

edited

Loading