python custom plugin #13583

johndou-and-friends · 2024-08-27T12:18:39Z

johndou-and-friends
Aug 27, 2024

version : kong:3.7.1-ubuntu

i have a custom plugin written in python for kong but when i run the kong in the docker its return error :

my project project structure is:

│
└───py_auth
| └─── py_auth.py
|
└───Dockerfile
└───docker-compose.yml
└───requirements.txt
└───pluginserver.py

my docker file content:

FROM kong:3.7.1-ubuntu

USER root
ADD ./sources.list /etc/apt/sources.list
RUN apt-get clean
RUN apt-get update && apt-get upgrade -y
RUN apt-get install python3 python3-pip musl-dev libffi-dev gcc g++ file make -y

RUN mkdir /usr/local/kong/python_plugin/ -p

COPY . /usr/local/kong/python_plugin/
COPY ./requirements.txt /usr/local/kong/python_plugin/requirements.txt

RUN pip install -r /usr/local/kong/python_plugin/requirements.txt


COPY --chown=kong --chmod=777 pluginserver.py /usr/local/bin/kong-python-pluginserver
COPY --chown=kong --chmod=777 ./py_auth /usr/local/share/lua/5.1/kong/plugins/

pluginserver.py file

#!/usr/bin/env python3

from kong_pdk import cli
cli.start_server()

and my docker-compose content:


version: '3.9'

x-kong-config:
  &kong-env
  KONG_DATABASE: ${KONG_DATABASE:-off}
  KONG_PG_DATABASE: ${KONG_PG_DATABASE:-kong}
  KONG_PG_HOST: db
  KONG_PG_USER: ${KONG_PG_USER:-kong}
  KONG_PG_PASSWORD_FILE: /run/secrets/kong_postgres_password

volumes:
  kong_data: { }
  kong_prefix_vol:
    driver_opts:
      type: tmpfs
      device: tmpfs
  kong_tmp_vol:
    driver_opts:
      type: tmpfs
      device: tmpfs

networks:
  kong-net:
    external: false

services:
  kong-migrations:
    image: "${KONG_DOCKER_TAG:-kong:latest}"
    container_name: kong-migrations
    command: kong migrations bootstrap
    profiles: [ "database" ]
    depends_on:
      - db
    environment:
      <<: *kong-env
    secrets:
      - kong_postgres_password
    networks:
      - kong-net
    restart: on-failure

  kong-migrations-up:
    image: "${KONG_DOCKER_TAG:-kong:latest}"
    container_name: kong-migrations-up
    command: kong migrations up && kong migrations finish
    profiles: [ "database" ]
    depends_on:
      - db
    environment:
      <<: *kong-env
    secrets:
      - kong_postgres_password
    networks:
      - kong-net
    restart: on-failure

  kong:
    build: .
    # container_name: kong-gateway-server
    user: "${KONG_USER:-kong}"
    environment:
      <<: *kong-env
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_PROXY_LISTEN: "${KONG_PROXY_LISTEN:-0.0.0.0:9000}"
      KONG_ADMIN_LISTEN: "${KONG_ADMIN_LISTEN:-0.0.0.0:9001}"
      KONG_ADMIN_GUI_LISTEN: "${KONG_ADMIN_GUI_LISTEN:-0.0.0.0:9002}"
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_PREFIX: ${KONG_PREFIX:-/var/run/kong}
      KONG_DECLARATIVE_CONFIG: "/opt/kong/kong.yaml"
#
      KONG_PLUGINS: bundled, py_auth
#      KONG_PLUGINSERVER_NAMES: py_auth
#      KONG_PLUGINSERVER_PY_OAUTH_START_CMD: /usr/local/bin/kong-python-pluginserver  --plugins-directory /usr/local/share/lua/5.1/kong/plugins/
#      KONG_PLUGINSERVER_PY_OAUTH_QUERY_CMD: /usr/local/bin/kong-python-pluginserver  --plugins-directory /usr/local/share/lua/5.1/kong/plugins/ --dump-all-plugins
      KONG_PLUGINSERVER_NAMES: py_auth
      KONG_PLUGINSERVER_PY_AUTH_SOCKET: /usr/local/kong/python_pluginserver.sock
      KONG_PLUGINSERVER_PY_AUTH_START_CMD: >-
        /usr/local/bin/kong-python-pluginserver
        --plugins-directory /usr/local/share/lua/5.1/kong/plugins/py_auth
        --dump-all-plugins
      KONG_PLUGINSERVER_PY_AUTH_QUERY_CMD: >-
        /usr/local/bin/kong-python-pluginserver
        --plugins-directory /usr/local/share/lua/5.1/kong/plugins/py_auth
        --dump-all-plugins
    secrets:
      - kong_postgres_password
    networks:
      - kong-net
    dns:
      - 4.2.2.2
      - 1.1.1.1
      - 8.8.8.8
    ports:
      # The following two environment variables default to an insecure value (0.0.0.0)
      # according to the CIS Security test.
      - "${KONG_INBOUND_PROXY_LISTEN:-0.0.0.0}:9000:9000/tcp"
      # - "${KONG_INBOUND_SSL_PROXY_LISTEN:-0.0.0.0}:7444:7444/tcp"
      # Making them mandatory but undefined, like so would be backwards-breaking:
      # - "${KONG_INBOUND_PROXY_LISTEN?Missing inbound proxy host}:8000:8000/tcp"
      # - "${KONG_INBOUND_SSL_PROXY_LISTEN?Missing inbound proxy ssl host}:8443:8443/tcp"
      # Alternative is deactivating check 5.13 in the security bench, if we consider Kong's own config to be enough security here

      #- "7444:7444/tcp"
      - "9001:9001/tcp"
      - "9002:9002/tcp"
    healthcheck:
      test: [ "CMD", "kong", "health" ]
      interval: 10s
      timeout: 10s
      retries: 10
    restart: on-failure:5
    read_only: true
    volumes:
      - kong_prefix_vol:${KONG_PREFIX:-/var/run/kong}
      - kong_tmp_vol:/tmp
      - ./config:/opt/kong
    security_opt:
      - no-new-privileges

  db:
    image: postgres:9.5
    # container:name: kong-db
    profiles: [ "database" ]
    environment:
      POSTGRES_DB: ${KONG_PG_DATABASE:-kong}
      POSTGRES_USER: ${KONG_PG_USER:-kong}
      POSTGRES_PASSWORD_FILE: /run/secrets/kong_postgres_password
    secrets:
      - kong_postgres_password
    healthcheck:
      test:
        [
          "CMD",
          "pg_isready",
          "-d",
          "${KONG_PG_DATABASE:-kong}",
          "-U",
          "${KONG_PG_USER:-kong}"
        ]
      interval: 30s
      timeout: 30s
      retries: 3
    restart: on-failure
    stdin_open: true
    tty: true
    networks:
      - kong-net
    volumes:
      - kong_data:/var/lib/postgresql/data

#  konga:
#    image: pantsel/konga
#    ports:
#      - 1337:1337
#    links:
#      - kong:kong
#    container_name: konga
#    environment:
#      - NODE_ENV=production
secrets:
  kong_postgres_password:
    file: ./POSTGRES_PASSWORD

and my py_auth/py_auth.py content:

#!/usr/bin/env python3
#https://docs.konghq.com/gateway/latest/plugin-development/pdk/kong.service/
import os
import kong_pdk.pdk.kong as kong
from keycloak import KeycloakOpenID



Schema = (
    {"oauth_server": {"type": "string"}},
    {"oauth_client_id": {"type": "string"}},
    {"oauth_client_secret": {"type": "string"}},
    {"oauth_realm_name": {"type": "string"}},
    {"oauth_verify": {"type": "boolean"}},
)

version = '1.0.0'
priority = 5000



class HandyUtils(object):

    def plugin_log(self, message):
        """Custom plugin log messages"""
        message = f"[Python Plugin auth]: " + message
        return kong.log.err(message)


class Plugin(HandyUtils):
    def __init__(self, config):
        """constructor method
        """
        self.config = config
        self.keycloak_openid = KeycloakOpenID(
            server_url=config.get("oauth_server"),
            client_id=config.get("oauth_client_id"),
            realm_name=config.get("oauth_realm_name"),
            client_secret_key=config.get("oauth_client_secret"),
            verify=config.get("oauth_verify"),
        )

    def access(self, kong: kong.kong):
        """
        Executed for every request from a client and before it is being proxied to the upstream service.
        https://docs.konghq.com/gateway/latest/plugin-development/custom-logic/
        """
        kong.response.set_header("x-python-pid", str(os.getpid()))
        kong.response.set_header("x-plugin-get", "ok")

if __name__ == "__main__":
    from kong_pdk.cli import start_dedicated_server
    start_dedicated_server("py_auth", Plugin, version, priority, Schema)

container logs

kong-1              | 2024/08/27 12:12:23 [warn] 1#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /var/run/kong/nginx.conf:7
kong-1              | nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /var/run/kong/nginx.conf:7
kong-migrations-up exited with code 0
kong-migrations exited with code 0
kong-1              | /usr/local/bin/kong-python-pluginserver: 2: from: not found
kong-1              | /usr/local/bin/kong-python-pluginserver: 3: Syntax error: Bad function name
kong-1              | 2024/08/27 12:12:23 [error] 1#0: init_by_lua error: ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: Not a plugin info table:
kong-1              | /usr/local/bin/kong-python-pluginserver --plugins-directory /usr/local/share/lua/5.1/kong/plugins/ --dump-all-plugins
kong-1              |
kong-1              | stack traceback:
kong-1              |   [C]: in function 'error'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: in function 'ask_info'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:164: in function 'get_plugin_info'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:362: in function 'get_plugin'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:370: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:159: in function 'load_plugin_handler'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:263: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:315: in function 'load_plugin_schemas'
kong-1              |   /usr/local/share/lua/5.1/kong/init.lua:707: in function 'init'
kong-1              |   init_by_lua(nginx-kong.conf:41):3: in main chunk
kong-1              | nginx: [error] init_by_lua error: ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: Not a plugin info table:
kong-1              | /usr/local/bin/kong-python-pluginserver --plugins-directory /usr/local/share/lua/5.1/kong/plugins/ --dump-all-plugins
kong-1              |
kong-1              | stack traceback:
kong-1              |   [C]: in function 'error'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: in function 'ask_info'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:164: in function 'get_plugin_info'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:362: in function 'get_plugin'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:370: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:159: in function 'load_plugin_handler'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:263: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:315: in function 'load_plugin_schemas'
kong-1              |   /usr/local/share/lua/5.1/kong/init.lua:707: in function 'init'
kong-1              |   init_by_lua(nginx-kong.conf:41):3: in main chunk
kong-1 exited with code 1
kong-1              | 2024/08/27 12:12:25 [warn] 1#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /var/run/kong/nginx.conf:7
kong-1              | nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /var/run/kong/nginx.conf:7
kong-1              | /usr/local/bin/kong-python-pluginserver: 2: from: not found
kong-1              | /usr/local/bin/kong-python-pluginserver: 3: Syntax error: Bad function name
kong-1              | 2024/08/27 12:12:25 [error] 1#0: init_by_lua error: ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: Not a plugin info table:
kong-1              | /usr/local/bin/kong-python-pluginserver --plugins-directory /usr/local/share/lua/5.1/kong/plugins/ --dump-all-plugins
kong-1              |
kong-1              | stack traceback:
kong-1              |   [C]: in function 'error'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: in function 'ask_info'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:164: in function 'get_plugin_info'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:362: in function 'get_plugin'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:370: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:159: in function 'load_plugin_handler'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:263: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:315: in function 'load_plugin_schemas'
kong-1              |   /usr/local/share/lua/5.1/kong/init.lua:707: in function 'init'
kong-1              |   init_by_lua(nginx-kong.conf:41):3: in main chunk
kong-1              | nginx: [error] init_by_lua error: ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: Not a plugin info table:
kong-1              | /usr/local/bin/kong-python-pluginserver --plugins-directory /usr/local/share/lua/5.1/kong/plugins/ --dump-all-plugins
kong-1              |
kong-1              | stack traceback:
kong-1              |   [C]: in function 'error'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: in function 'ask_info'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:164: in function 'get_plugin_info'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:362: in function 'get_plugin'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:370: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:159: in function 'load_plugin_handler'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:263: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:315: in function 'load_plugin_schemas'
kong-1              |   /usr/local/share/lua/5.1/kong/init.lua:707: in function 'init'
kong-1              |   init_by_lua(nginx-kong.conf:41):3: in main chunk
kong-1              | 2024/08/27 12:12:28 [warn] 1#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /var/run/kong/nginx.conf:7
kong-1              | nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /var/run/kong/nginx.conf:7
kong-1              | /usr/local/bin/kong-python-pluginserver: 2: from: not found
kong-1              | /usr/local/bin/kong-python-pluginserver: 3: Syntax error: Bad function name
kong-1              | 2024/08/27 12:12:28 [error] 1#0: init_by_lua error: ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: Not a plugin info table:
kong-1              | /usr/local/bin/kong-python-pluginserver --plugins-directory /usr/local/share/lua/5.1/kong/plugins/ --dump-all-plugins
kong-1              |
kong-1              | stack traceback:
kong-1              |   [C]: in function 'error'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: in function 'ask_info'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:164: in function 'get_plugin_info'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:362: in function 'get_plugin'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:370: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:159: in function 'load_plugin_handler'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:263: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:315: in function 'load_plugin_schemas'
kong-1              |   /usr/local/share/lua/5.1/kong/init.lua:707: in function 'init'
kong-1              |   init_by_lua(nginx-kong.conf:41):3: in main chunk
kong-1              | nginx: [error] init_by_lua error: ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: Not a plugin info table:
kong-1              | /usr/local/bin/kong-python-pluginserver --plugins-directory /usr/local/share/lua/5.1/kong/plugins/ --dump-all-plugins
kong-1              |
kong-1              | stack traceback:
kong-1              |   [C]: in function 'error'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:145: in function 'ask_info'
kong-1              |   ...al/share/lua/5.1/kong/runloop/plugin_servers/process.lua:164: in function 'get_plugin_info'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:362: in function 'get_plugin'
kong-1              |   ...local/share/lua/5.1/kong/runloop/plugin_servers/init.lua:370: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:159: in function 'load_plugin_handler'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:263: in function 'load_plugin'
kong-1              |   /usr/local/share/lua/5.1/kong/db/dao/plugins.lua:315: in function 'load_plugin_schemas'
kong-1              |   /usr/local/share/lua/5.1/kong/init.lua:707: in function 'init'
kong-1              |   init_by_lua(nginx-kong.conf:41):3: in main chunk

johndou-and-friends · 2024-08-28T06:03:29Z

johndou-and-friends
Aug 28, 2024
Author

@greut
@jerodsanto
@cheald
@lukego

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

python custom plugin #13583

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment

{{title}}

Select a reply

python custom plugin #13583

johndou-and-friends Aug 27, 2024

my docker file content:

pluginserver.py file

and my docker-compose content:

and my py_auth/py_auth.py content:

container logs

Replies: 1 comment

johndou-and-friends Aug 28, 2024 Author

johndou-and-friends
Aug 27, 2024

johndou-and-friends
Aug 28, 2024
Author