Feature gates

Feature gates enable contributors to add and manage new (and potentially experimental) functionality to the Kong Ingress Controller in a controlled way. The features will be “hidden” until they are generally available (GA) and the progress and maturity of features on their path to GA will be documented. Feature gates also create a clear path for deprecating features.

Upstream Kubernetes includes feature gates, which enable or disable features with flags and track the maturity of a feature using feature stages. The same definitions of feature gates and feature stages from upstream Kubernetes are used to define KIC’s list of features.

The following feature gates are available:

• The since and until columns refer to KIC Releases.
• Features that are currently in alpha or beta states may become deprecated at any time. Deprecated features are removed during the next minor release.
• Until a feature becomes GA, there are no guarantees that it will continue being available. For more information, see the changelog.

Important: To avoid disrupting your services, consider not using features until they have reached GA status.

SanitizeKonnectConfigDumps

The SanitizeKonnectConfigDumps feature enables the sanitization of configuration dumps that are sent to Konnect. This means Kong Ingress Controller will obfuscate all sensitive information that your Kong config contains, such as private keys in Certificate entities and Consumer entities’ credentials.

Warning: KongPlugin’s and KongClusterPlugin’s config fields are not sanitized. If you have sensitive information in your KongPlugin’s config field, it will be sent to Konnect as is. To avoid this, use the KongVault resource.

CombinedServicesFromDifferentHTTPRoutes

The CombinedServicesFromDifferentHTTPRoutes feature enables translating HTTPRoute rules with the same set of backends (combination of namespace, name, port, and weight) from different HTTPRoutes in the same namespace into a single Kong Gateway Service. Enabling the feature gate can reduce the number of translated Kong Gateway Services.

The names of Kong Gateway Services will change if the feature gate is enabled. You can refer to the HTTRoutes reference page for further details.

Note: Since 3.5.0 this functionality is controlled via a CLI flag: --combined-services-from-different-httproutes.

To enable feature gates, provide the --feature-gates flag when launching KIC, or set the CONTROLLER_FEATURE_GATES environment variable.

Feature gates consist of a comma-delimited set of key=value pairs. For example, if you wanted to enable FillIDs and RewriteURIs, you’d set CONTROLLER_FEATURE_GATES=FillIDs=true,RewriteURIs=true.

To enable features via Helm, set the following in your values.yaml:

controller:
  ingressController:
    env:
      feature_gates: FillIDs=true,RewriteURIs=true

ingressController:
  env:
    feature_gates: FillIDs=true,RewriteURIs=true

To test a feature gate in an existing deployment, use kubectl set env.

kubectl set env -n kong deployment/kong-controller \
  CONTROLLER_FEATURE_GATES="FillIDs=true,RewriteURIs=true" \
  -c ingress-controller