Compatibility
Supported browsers
IE | Edge | Firefox | Chrome | Safari | |
---|---|---|---|---|---|
Kong Konnect |
Kong Gateway version compatibility
Kong Konnect | Beginning with version | End of support | |
---|---|---|---|
Kong Gateway Enterprise 3.6.x | 3.6.0.0 | Feb 2025 | |
Kong Gateway Enterprise 3.5.x | 3.5.0.0 | Nov 2024 | |
Kong Gateway Enterprise 3.4.x (LTS) | 3.4.0.0 | Aug 2026 | |
Kong Gateway Enterprise 3.3.x | 3.3.0.0 | May 2024 | |
Kong Gateway Enterprise 3.2.x | 3.2.1.0 | Feb 2024 | |
Kong Gateway Enterprise 3.1.x | 3.1.0.0 | Dec 2023 | |
Kong Gateway Enterprise 3.0.x | 3.0.0.0 | Sep 2023 | |
Kong Gateway Enterprise 2.8.x (LTS) | 2.8.0.0 | Mar 2025 | |
Kong Gateway Enterprise 2.7.x | 2.7.0.0 | Feb 2023 | |
Kong Gateway Enterprise 2.6.x | 2.6.0.0 | Feb 2023 | |
Kong Gateway Enterprise 2.5.x | 2.5.0.1 | Aug 2022 | |
Kong Gateway Enterprise 2.4.x or earlier | – | – |
Kong Mesh compatibility
To use Mesh Manager, you must also use a compatible version of Kong Mesh.
Kong Konnect | First supported patch version | |
---|---|---|
Kong Mesh 2.4.x | 2.4.1 | |
Kong Mesh 2.3.x or earlier | - |
Plugin compatibility
There are three tiers of plugins available in Kong Konnect:
The tiers denote plugin pricing. See the Konnect pricing page for more detail.
If you’re looking for supported network protocols and entity scopes, see Plugin Compatibility on the Plugin Hub.
Considerations for Dedicated Cloud Gateways
There are some limitations for plugins with Dedicated Cloud Gateways:
- Any plugins that depend on a local agent will not work with Dedicated Cloud Gateways.
- Any plugins that depend on the Status API or on Admin API endpoints will not work.
- Any plugins or functionality that depend on AWS IAM
AssumeRole
need to be configured differently. This includes Data Plane Resilience.
See the following table for details on each plugin.
Plugin tiers
AI
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
AI Prompt Decorator | -- | |||
AI Prompt Guard | -- | |||
AI Prompt Template | -- | |||
AI Proxy | -- | |||
AI Request Transformer | -- | |||
AI Response Transformer | -- |
Authentication
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
Portal Application Registration | Not Applicable | Not Applicable | Not Applicable |
Application registration is available in Konnect, but doesn't require this plugin. Learn how to Enable Application Registration in Konnect. |
Basic Authentication | -- | |||
HMAC Auth | -- | |||
JWE Decrypt | -- | |||
JWT | -- | |||
Kong JWT Signer | Not Applicable | Not Applicable | Not Applicable | -- |
Key Auth | The time-to-live (ttl) does not work in Konnect or hybrid mode. This setting determines the length of time a credential remains valid. | |||
Key Authentication - Encrypted | Not Applicable | Not Applicable | Not Applicable | The time-to-live (ttl) does not work in Konnect or hybrid mode. This setting determines the length of time a credential remains valid. |
LDAP Authentication | -- | |||
LDAP Authentication Advanced | -- | |||
Mutual TLS Authentication | -- | |||
OAuth 2.0 Authentication | Not Applicable | Not Applicable | Not Applicable | This plugin can't be used in Konnect, hybrid, or DB-less modes. It needs to generate and delete tokens, and commit those changes to a database on the same node. |
OAuth 2.0 Introspection | -- | |||
OpenID Connect | -- | |||
SAML | -- | |||
Session | -- | |||
Vault Authentication | Not Applicable | Not Applicable | Not Applicable | -- |
Security
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
ACME | -- | |||
Bot Detection | -- | |||
CORS | -- | |||
IP Restriction | -- | |||
OPA | -- | |||
TLS Handshake Modifier | -- | |||
TLS Metadata Headers | -- |
Traffic Control
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
ACL | -- | |||
Canary Release | The Canary plugin is not designed for a Kubernetes-native framework, and shouldn't be used with the Kong Ingress Controller. Instead, use the Gateway API to manage canary deploys. | |||
Forward Proxy Advanced | -- | |||
GraphQL Proxy Caching Advanced | -- | |||
GraphQL Rate Limiting Advanced |
In DB-less, hybrid mode, and Konnect, the cluster config strategy
is not supported. Use redis instead.
|
|||
Mocking | -- | |||
OAS Validation | -- | |||
Proxy Cache | -- | |||
Proxy Caching Advanced | -- | |||
Rate Limiting |
In Konnect, DB-less, and hybrid modes, the cluster config policy
is not supported.
For DB-less mode, use one of redis or local ;
for Konnect and hybrid mode, use redis , or local for data
planes only.
|
|||
Rate Limiting Advanced |
In Konnect, DB-less, and hybrid modes, the cluster config strategy
is not supported.
For DB-less mode, use one of redis or local ;
for Konnect and hybrid mode, use redis , or local for data
planes only.
|
|||
Request Size Limiting | -- | |||
Request Termination | -- | |||
Request Validator | -- | |||
Response Rate Limiting |
In Konnect, DB-less, and hybrid modes, the cluster config policy
is not supported.
For DB-less mode, use one of redis or local ;
for Konnect and hybrid mode, use redis , or local for data
planes only.
|
|||
Route By Header | -- | |||
Upstream Timeout | -- | |||
WebSocket Size Limit | -- | |||
WebSocket Validator | -- | |||
XML Threat Protection | -- |
Serverless
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
AWS Lambda | Dedicated Cloud Gateways: If you use the IAM assumeRole functionality with this plugin, it must be configured differently than for hybrid deployments in Konnect. | |||
Azure Functions | -- | |||
Apache OpenWhisk | Not Applicable | Not Applicable | Not Applicable |
Not bundled with Kong Gateway.
Installed as a LuaRocks package. |
Kong Functions (Post-Plugin) | ||||
Kong Functions (Pre-Plugins) |
Analytics & Monitoring
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
AppDynamics | Dedicated Cloud Gateways: This plugin is not supported in Dedicated Cloud Gateways because it depends on a local agent, and there are no local nodes in Dedicated Cloud Gateways. | |||
Datadog | -- | |||
OpenTelemetry | -- | |||
Prometheus | Dedicated Cloud Gateways: This plugin is not supported in Dedicated Cloud Gateways because it depends on the Admin API and the Status API, which aren't accessible in that setup. | |||
StatsD | -- | |||
StatsD Advanced | -- | |||
Zipkin | -- |
Transformations
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
Correlation ID | -- | |||
DeGraphQL | -- | |||
Exit Transformer | -- | |||
gRPC-gateway | -- | |||
gRPC-Web | -- | |||
jq | -- | |||
Kafka Upstream | -- | |||
Request Transformer | -- | |||
Request Transformer Advanced | -- | |||
Response Transformer | -- | |||
Response Transformer Advanced | -- | |||
Route Transformer Advanced | -- |
Logging
Plugin | Free | Paid | Premium | Notes |
---|---|---|---|---|
File Log | Dedicated Cloud Gateways: This plugin is not supported in Dedicated Cloud Gateways because it depends on a local agent, and there are no local nodes in Dedicated Cloud Gateways. | |||
HTTP Log | -- | |||
Kafka Log | -- | |||
Loggly | -- | |||
Syslog | Dedicated Cloud Gateways: This plugin is not supported in Dedicated Cloud Gateways because it depends on a local agent, and there are no local nodes in Dedicated Cloud Gateways. | |||
TCP Log | -- | |||
UDP Log | -- |