Stéphane Tailland
3de6809b75
Every hop was starting its own trace: a single end-to-end transaction through LibreChat, Kong and the backends appeared in Tempo as a dozen unrelated traces, one per service. Verified on twelve consecutive traces, each containing exactly one service. Kong receives a W3C traceparent -- it is visible in the http-log records -- but without a propagation block it neither continues the caller's trace nor passes one downstream, so it minted a fresh trace id per request and the backends did the same. extract lists w3c first with b3 and jaeger as fallbacks, since the callers here are a mix of OTel SDKs; inject is w3c only, which is what the Python and Java agents downstream expect. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
120 lines
2.6 KiB
YAML
120 lines
2.6 KiB
YAML
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-openid-connect
|
|
namespace: ${NAMESPACE}
|
|
plugin: openid-connect
|
|
config:
|
|
issuer: ${OIDC_ISSUER}
|
|
audience_required: ${JWT_AUDIENCE_WHITELIST}
|
|
auth_methods:
|
|
- bearer
|
|
display_errors: false
|
|
ssl_verify: true
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-rate-limiting
|
|
namespace: ${NAMESPACE}
|
|
plugin: rate-limiting-advanced
|
|
config:
|
|
limit:
|
|
- ${RATE_LIMIT_MINUTE}
|
|
window_size:
|
|
- 60
|
|
sync_rate: -1
|
|
strategy: local
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-cors
|
|
namespace: ${NAMESPACE}
|
|
plugin: cors
|
|
config:
|
|
origins:
|
|
- ${CORS_ORIGINS}
|
|
methods:
|
|
- GET
|
|
- POST
|
|
- PUT
|
|
- PATCH
|
|
- DELETE
|
|
- OPTIONS
|
|
credentials: true
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-request-size-limiting
|
|
namespace: ${NAMESPACE}
|
|
plugin: request-size-limiting
|
|
config:
|
|
allowed_payload_size: ${REQUEST_MAX_BODY_SIZE}
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-correlation-id
|
|
namespace: ${NAMESPACE}
|
|
plugin: correlation-id
|
|
config:
|
|
header_name: X-Correlation-ID
|
|
generator: uuid
|
|
echo_downstream: true
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-hide-5xx-details
|
|
namespace: ${NAMESPACE}
|
|
plugin: response-transformer-advanced
|
|
config:
|
|
replace:
|
|
body: '{"error": "internal_server_error", "message": "An unexpected error occurred."}'
|
|
if_status:
|
|
- "500"
|
|
- "502"
|
|
- "503"
|
|
- "504"
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-prometheus
|
|
namespace: ${NAMESPACE}
|
|
plugin: prometheus
|
|
config:
|
|
status_code_metrics: true
|
|
latency_metrics: true
|
|
bandwidth_metrics: true
|
|
upstream_health_metrics: true
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-opentelemetry
|
|
namespace: ${NAMESPACE}
|
|
plugin: opentelemetry
|
|
config:
|
|
traces_endpoint: ${OTEL_TRACES_ENDPOINT}
|
|
resource_attributes:
|
|
service.name: ${NAME}
|
|
sampling_rate: 1
|
|
http_response_header_for_traceid: X-Trace-Id
|
|
# Without this block every hop starts its own trace: a single end-to-end
|
|
# transaction shows up in Tempo as a dozen unrelated traces, one per service.
|
|
# `extract` is what makes the gateway continue the caller's trace instead of
|
|
# opening a new one, and `inject` is what carries it to the upstream so the
|
|
# backend can continue it in turn.
|
|
propagation:
|
|
extract:
|
|
- w3c
|
|
- b3
|
|
- jaeger
|
|
inject:
|
|
- w3c
|
|
default_format: w3c
|
|
clear: []
|