☔ Custom plugin distribution

[lahabana]

Problem Statement

Custom plugins are a large part of customer deployments, but getting these plugins deployed and configured with a Kong Gateway instance has been painful. Since KGO aims to offer the E2E operational model for Kong Gateway on Kubernetes it should provide a way to ship and use custom plugins with Kong Gateways deployed and managed by KGO.

Proposed Solution

Documents:

The most up-to-date and comprehensive Engineering brief that was created based on the

• Kong Gateway Plugin Distribution
• Kong Custom Plugin Management for Kubernetes
• Product Brief: Custom Plugin Streaming

Acceptance Criteria

• A user can write a custom plugin that's up to 1MB put it in their OCI registry and run it by installing a CRD
• Documentation is available
• User call scheduled to demonstrate this feature

Issues planned (order matters)

Core scope/functionaliies

• Spike: Kong Gateway plugins distribution #113
• New CRD for custom Kong Plugin installation #378
• Controller of Kong Plugin installation CRD is able to fetch OCI image and unpack content to ConfigMap #379
• Require ReferenceGrant for cross-namepsace access to a Secret by KongPluginInstallation #610
• Allow configuring additional plugins for Dataplane - Kong Gateway #380
• Provide comprehensive documentation for custom Kong Plugin distribution and usage with KGO  #381

Additional, but still important

• Streamline and automatize/document testing strategy for KongPluginInstallation CRDs #465

Nice to have

• Do not create temporary file when dealing with container registry credentials #521

Issues for future milestones

• Signature verification for custom plugins #372