Capture request/response bodies for audit-log via pre/post-function

Body capture lives in dedicated audit-log-body-capture(-bindings).yaml
files, separate from audit-log.yaml itself, so they can be dropped
without touching the base logging plugin (degrades gracefully to
metadata-only via nil custom_fields). Response body captured in
body_filter (chunk-accumulated) rather than the log phase, which
cannot call kong.response.get_raw_body() directly.

kong/kustomization.yaml

@@ -9,6 +9,8 @@ resources:
   - rest/rate-limiting.yaml
   - rest/proxy-cache.yaml
   - rest/audit-log.yaml
+  - rest/audit-log-body-capture.yaml
+  - rest/audit-log-body-capture-bindings.yaml
   - rest/pluginbindings.yaml
   - mcp/service.yaml
   - mcp/routes.yaml
@@ -16,4 +18,6 @@ resources:
   - mcp/ai-mcp-proxy.yaml
   - mcp/openid-connect.yaml
   - mcp/audit-log.yaml
+  - mcp/audit-log-body-capture.yaml
+  - mcp/audit-log-body-capture-bindings.yaml
   - mcp/pluginbindings.yaml

kong/mcp/audit-log-body-capture-bindings.yaml

@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-mcp-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-mcp-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-mcp-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-mcp-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-mcp

kong/mcp/audit-log-body-capture.yaml

@@ -0,0 +1,27 @@
+# dev only: captures raw request/response bodies into kong.ctx.shared for
+# audit-log.yaml's custom_fields_by_lua to read back in the log phase.
+# Drop this file (and its bindings) to stop body capture without touching
+# audit-log.yaml itself — it degrades gracefully to metadata-only logging.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-mcp-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-mcp-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end

kong/mcp/audit-log.yaml

@@ -5,8 +5,13 @@ metadata:
   namespace: ${NAMESPACE}
 plugin: http-log
 # dev only: the raw Authorization (JWT) header is captured in clear text,
-# not acceptable as-is for a non-dev environment.
+# not acceptable as-is for a non-dev environment. request_body/response_body
+# below read from kong.ctx.shared, populated by audit-log-body-capture.yaml
+# — nil (and silently omitted) if that file isn't applied.
 config:
   http_endpoint: ${AUDIT_LOG_ENDPOINT}
   method: POST
   content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"

kong/rest/audit-log-body-capture-bindings.yaml

@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-api-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-api-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-api-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-api-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-api

kong/rest/audit-log-body-capture.yaml

@@ -0,0 +1,27 @@
+# dev only: captures raw request/response bodies into kong.ctx.shared for
+# audit-log.yaml's custom_fields_by_lua to read back in the log phase.
+# Drop this file (and its bindings) to stop body capture without touching
+# audit-log.yaml itself — it degrades gracefully to metadata-only logging.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-api-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-api-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end

kong/rest/audit-log.yaml

@@ -5,8 +5,13 @@ metadata:
   namespace: ${NAMESPACE}
 plugin: http-log
 # dev only: the raw Authorization (JWT) header is captured in clear text,
-# not acceptable as-is for a non-dev environment.
+# not acceptable as-is for a non-dev environment. request_body/response_body
+# below read from kong.ctx.shared, populated by audit-log-body-capture.yaml
+# — nil (and silently omitted) if that file isn't applied.
 config:
   http_endpoint: ${AUDIT_LOG_ENDPOINT}
   method: POST
   content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"