CNAPP-24034 Kong #23

Sanskarzz · 2025-12-24T06:53:27Z

Description

Kong Gateway Integration with SentryFlow

This guide describes how to integrate Kong Gateway with SentryFlow for API security monitoring.

Steps

1. Install Kong Gateway

helm repo add kong https://charts.konghq.com
helm repo update

# Install Kong with default settings (CRDs disabled for kind if preferred)
helm install kong kong/kong \
  --namespace kong \
  --create-namespace \
  --set ingressController.installCRDs=false \
  --set admin.enabled=true \
  --set admin.type=NodePort

2. Install SentryFlow Custom Plugin

We need to mount the sentryflow-log plugin into the Kong proxy container.

Create ConfigMap from plugin files:

# Create ConfigMap
kubectl create configmap sentryflow-log-plugin \
  --from-file=handler.lua=filter/kong/sentryflow-log/handler.lua \
  --from-file=schema.lua=filter/kong/sentryflow-log/schema.lua \
  -n kong

Patch Kong Deployment:

Mount the plugin into the proxy container (usually index 1) and the ingress-controller (index 0).

kubectl patch deployment kong-kong -n kong --type=json -p='[
  {
    "op": "add",
    "path": "/spec/template/spec/volumes/-",
    "value": {
      "name": "sentryflow-log-plugin",
      "configMap": {
        "name": "sentryflow-log-plugin"
      }
    }
  },
  {
    "op": "add",
    "path": "/spec/template/spec/containers/1/volumeMounts/-",
    "value": {
      "name": "sentryflow-log-plugin",
      "mountPath": "/usr/local/share/lua/5.1/kong/plugins/sentryflow-log",
      "readOnly": true
    }
  }
]'

# Enable the plugin in Kong
kubectl set env deployment/kong-kong -n kong KONG_PLUGINS=bundled,sentryflow-log

Note: Ensure the volumeMount is applied to the proxy container.

3. Deploy SentryFlow

Deploy SentryFlow with Kong receiver enabled.

helm upgrade --install sentryflow \
  ./deployments/sentryflow \
  --namespace sentryflow \
  --create-namespace \
  --set image.repository=sanskardevops/sentryflow \
  --set image.tag=latest \
  --set config.receivers.kongGateway.enabled=true \
  --set config.receivers.kongGateway.namespace=kong \
  --set config.receivers.kongGateway.deploymentName=kong-kong

4. Enable sentryflow-log Plugin Globally

Create a KongClusterPlugin to enable logging for all routes.

kubectl apply -f - <<EOF
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: sentryflow-log
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: "true"
plugin: sentryflow-log
config:
  http_endpoint: "http://sentryflow.sentryflow:8081/api/v1/events"
  timeout: 10000
  keepalive: 60000
EOF

5. Patch Discovery Engine

Update the discovery-engine ConfigMap (discovery-engine-sumengine) to use SentryFlow and restart the deployment.

kubectl -n agents edit configmap discovery-engine-sumengine 
` ``

```yaml
  data:
  app.yaml: |
    ...
    summary-engine:
      sentryflow:
        cron-interval: 0h0m30s
        decode-jwt: true
        enabled: true
        include-bodies: true
        redact-sensitive-data: false
        sensitive-rules-files-path:
        - /var/lib/sumengine/sensitive-data-rules.yaml
        threshold: 10000
    watcher:
    ...
      sentryflow:
        enabled: true
        event-type:
          access-log: true
          metric: false
        service:
          enabled: true
          name: sentryflow
          port: "8080"
          url: "sentryflow.sentryflow"

kubectl -n agents rollout restart deployment/discovery-engine

Verification Guide

1. Deploy Sample Application

Deploy the Google Microservices Demo frontend service (or any HTTP service).

# Verify frontend service exists
kubectl get svc

2. Create Ingress Resource

Create an Ingress to route traffic through Kong to your service.

kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: frontend-ingress
  annotations:
    konghq.com/strip-path: "true"
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend
                port:
                  number: 80
EOF

3. Generate Traffic

Port-forward the Kong proxy and send requests.

# Port forward Kong Proxy
kubectl port-forward -n kong svc/kong-kong-proxy 8000:80 &

# Send traffic
sleep 2
curl -s http://localhost:8000/ > /dev/null
curl -s http://localhost:8000/cart > /dev/null

4. Verify SentryFlow Logs

Check SentryFlow logs to confirm it received the events.

kubectl -n sentryflow logs deployment/sentryflow --tail=50

You should see logs indicating receipt of events:

{"level":"INFO",...,"msg":"Received API Event from kong"}

Related ticket CNAPP-24034

Fix race condition nginx

…ller-issues Fix nginx ingress controller issues

Add buffer for channel

Enhance helm hooks and add readme

Signed-off-by: avithe-great <avinash.maurya@accuknox.com>

updated proto for sentryflow

…add sentryflow changes and github actions Fix unit tests and add unit tests for gateway Fix typo in values

…io-gateway-receiver FEAT: CNAPP-23269 Add wasm-plugin support for istio-ingressgateway ,…

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

JonesJefferson · 2026-01-05T06:26:59Z

docs/kong-integration.md

+Deploy SentryFlow with Kong receiver enabled.
+
+```shell
+helm upgrade --install sentryflow \


Please change this to install an actual helm chart from ECR. We can update this section after we merge and create a new release

JonesJefferson · 2026-01-05T06:29:27Z

deployments/sentryflow/templates/configmap.yaml

        sidecarTag: {{ .Values.config.receivers.istio.sidecarTag | default "latest-sidecar" }}
      {{- end }}

+      {{- if .Values.config.receivers.kongGateway.enabled }}


also update the default.yaml config and comment the configs out

can you please explain this more

theres a file called default.yaml where we need to update this

JonesJefferson · 2026-01-05T06:37:05Z

sentryflow/pkg/core/server.go

 		return
 	}

+	m.Logger.Infof("Received API Event from %s", apiEvent.Metadata.ReceiverName)


please change this to a debug log

JonesJefferson · 2026-01-05T06:42:06Z

docs/kong-integration.md

+**Create ConfigMap from plugin files:**
+
+```shell
+# Create ConfigMap


package these lua files with helm. Have helm create config map with these files

JonesJefferson · 2026-01-05T06:43:14Z

filter/kong/sentryflow-log/handler.lua

+    },
+    response = {
+      headers = res_headers,
+      body = "", -- Response body capture requires buffering


we do need the body regardless. We can have a limit of say 1mb and capture the body

JonesJefferson · 2026-01-05T06:43:35Z

filter/kong/sentryflow-log/handler.lua

+    },
+    request = {
+      headers = req_headers,
+      body = "", -- Kong doesn't easily provide request body in log phase


can we tap into a different phase in that case? We need the body

i have updated it to capture using kong.request.get_raw_body() and kong.service.response.get_raw_body().

JonesJefferson · 2026-01-05T06:48:59Z

filter/kong/sentryflow-log/handler.lua

+      headers = res_headers,
+      body = "", -- Response body capture requires buffering
+    },
+    protocol = var.server_protocol or "HTTP/1.1",


this will almost never be empty. But even if it is we cannot assume it will be "HTTP/1.1". Could you please confirm this

I have changed the default protocol fallback to an empty string instead of "HTTP/1.1".

JonesJefferson · 2026-01-05T06:50:12Z

filter/kong/sentryflow-log/schema.lua

+        fields = {
+          { http_endpoint = typedefs.url({
+              required = true,
+              description = "SentryFlow HTTP endpoint URL (e.g., http://sentryflow.sentryflow:8081/api/v1/events)" -- { sentryflow.sentryflow is default name of sentryflow deployment.namespace update if its different for the setup}


this should be configured through helm install

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

avithe-great and others added 14 commits November 21, 2025 11:23

Merge pull request accuknox#14 from accuknox/fix-race-condition-nginx

90fd47b

Fix race condition nginx

Fix nginx ingress controller issues

631acbc

Merge pull request accuknox#15 from accuknox/fix-nginx-ingress-contro…

998b323

…ller-issues Fix nginx ingress controller issues

Add buffer for channel

89601d3

Merge pull request accuknox#7 from accuknox/enhancement

d0011e4

Add buffer for channel

Enhance helm hooks and add readme

e5321ed

Merge pull request accuknox#16 from accuknox/more-enhancements

c0e2557

Enhance helm hooks and add readme

Update app version

3d74c0b

updated proto for sentryflow

5f8ec0e

Signed-off-by: avithe-great <avinash.maurya@accuknox.com>

Merge pull request accuknox#17 from accuknox/feat-proto

e2a3681

updated proto for sentryflow

FEAT: CNAPP-23269 Add wasm-plugin support for istio-ingressgateway , …

10190c6

…add sentryflow changes and github actions Fix unit tests and add unit tests for gateway Fix typo in values

Address comments

32a8304

Merge pull request accuknox#19 from charankamal20/CNAPP-23269/add-ist…

242a4a3

…io-gateway-receiver FEAT: CNAPP-23269 Add wasm-plugin support for istio-ingressgateway ,…

CNAPP-24034 Kong

39b7e0c

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

Sanskarzz requested review from JonesJefferson, avithe-great and charankamal20 December 24, 2025 06:53

charankamal20 approved these changes Dec 24, 2025

View reviewed changes

JonesJefferson reviewed Jan 5, 2026

View reviewed changes

Sanskarzz added 2 commits January 5, 2026 20:52

fix: review fix

1a28928

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

fix

c728150

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

JonesJefferson force-pushed the main branch from c94da18 to c217aae Compare January 9, 2026 05:59

CNAPP-24034 Kong #23

Are you sure you want to change the base?

CNAPP-24034 Kong #23

Uh oh!

Conversation

Sanskarzz commented Dec 24, 2025 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Kong Gateway Integration with SentryFlow

Steps

1. Install Kong Gateway

2. Install SentryFlow Custom Plugin

3. Deploy SentryFlow

4. Enable sentryflow-log Plugin Globally

5. Patch Discovery Engine

Verification Guide

1. Deploy Sample Application

2. Create Ingress Resource

3. Generate Traffic

4. Verify SentryFlow Logs

Uh oh!

JonesJefferson Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Sanskarzz commented Dec 24, 2025 •

edited by atlassian bot

Loading

JonesJefferson Jan 5, 2026 •

edited

Loading