jwt-signer in hybrid mode

One Service and Route for the public JWKS, and the jwt-signer plugin pointed at the bridge's private listener.

decK configuration

_format_version: "3.0"
services:
  - name: jwks-bridge-public
    url: http://jwks-bridge.jwks.svc:8080
    routes:
      - name: jwks
        paths: ["/.well-known/jwks.json"]
        protocols: ["http", "https"]
        strip_path: false
        methods: ["GET"]
    plugins:
      - name: proxy-cache
        config:
          strategy: memory
          response_code: [200]
          content_type: ["application/jwk-set+json"]
          cache_ttl: 300

  - name: orders-api
    url: http://orders.backend.svc:8080
    routes:
      - name: orders
        paths: ["/orders"]
    plugins:
      - name: jwt-signer
        config:
          access_token_jwks_uri: https://idp.example.com/.well-known/jwks.json
          access_token_issuer: https://api.example.com
          access_token_signing: true
          access_token_signing_algorithm: RS256
          access_token_upstream_header: "Authorization:Bearer"
          access_token_keyset: https://jwks-bridge.jwks.svc:8443/keyset?name=default
          access_token_keyset_rotate_period: 300
          access_token_endpoints_ssl_verify: true
          access_token_keyset_client_username: "{vault://env/jwks-bridge-user}"
          access_token_keyset_client_password: "{vault://env/jwks-bridge-pass}"
          channel_token_optional: true

Plugin fields that matter

Field	Value
`access_token_keyset`	The bridge private URL. `/keyset?name=<keyset>` and `/keyset/<keyset>` are equivalent.
`access_token_signing_algorithm`	Must match the `alg` of the active key.
`access_token_keyset_rotate_period`	Seconds between keyset reloads on each data plane. Sets how long a promotion takes to reach every node.
`access_token_endpoints_ssl_verify`	Keep it on. The data planes must trust the bridge certificate.
`access_token_keyset_client_username` / `_password`	Basic auth to the bridge. Both fields accept Kong vault references.
`access_token_keyset_client_certificate`	A Kong certificate entity presented for mTLS, instead of Basic auth.

Trust the bridge certificate

Add the CA that signed the bridge certificate to lua_ssl_trusted_certificate on every data plane. With the Kong Helm chart:

env:
  lua_ssl_trusted_certificate: system,/etc/secrets/jwks-bridge-ca/ca.crt
secretVolumes:
  - jwks-bridge-ca

Backends

Backends validate iss (the access_token_issuer value) and the signature against https://<kong-proxy>/.well-known/jwks.json. They must look keys up by kid and refresh the JWKS on a timer.

Konnect

In Konnect, when signing is on and an upstream header is set, the plugin schema requires the keyset to be a valid URL, which is what jwks-bridge provides. Run the bridge in the same network zone as the Konnect data planes; the control plane never calls it.

Introduction

Kong

Operations

Reference