Self-Hosted API Gateway Plugin Ecosystems: Kong vs APISIX vs Envoy (2026)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

# docker-compose.yml for Kong with custom plugin
version: "3.8"
services:
  kong:
    image: kong:3.6
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: postgres
      KONG_PG_USER: kong
      KONG_PG_PASSWORD: kong
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_ADMIN_LISTEN: 0.0.0.0:8001
      KONG_PLUGINS: bundled,my-custom-plugin
    ports:
      - "8000:8000"
      - "8443:8443"
      - "8001:8001"
      - "8444:8444"
    volumes:
      - ./plugins:/usr/local/share/lua/5.1/kong/plugins:ro
    depends_on:
      - postgres

  postgres:
    image: postgres:15
    environment:
      POSTGRES_USER: kong
      POSTGRES_PASSWORD: kong
      POSTGRES_DB: kong
    volumes:
      - kong_data:/var/lib/postgresql/data

volumes:
  kong_data:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

-- /usr/local/share/lua/5.1/kong/plugins/my-custom-plugin/handler.lua
local BasePlugin = require "kong.plugins.base_plugin"

local MyPluginHandler = BasePlugin:extend()
MyPluginHandler.PRIORITY = 1000
MyPluginHandler.VERSION = "1.0.0"

function MyPluginHandler:new()
  MyPluginHandler.super.new(self, "my-custom-plugin")
end

function MyPluginHandler:access(config)
  MyPluginHandler.super.access(self)
  
  -- Add custom header
  kong.service.request.set_header("X-Custom-Plugin", "active")
  
  -- Rate limit by custom logic
  local client_ip = kong.client.get_ip()
  kong.log.debug("Request from: " .. client_ip)
end

return MyPluginHandler

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

version: "3.8"
services:
  apisix:
    image: apache/apisix:3.9.0
    restart: always
    ports:
      - "9080:9080"
      - "9443:9443"
      - "9180:9180"
    volumes:
      - ./apisix.yaml:/usr/local/apisix/conf/apisix.yaml:ro
    depends_on:
      - etcd

  etcd:
    image: bitnami/etcd:3.5
    restart: always
    environment:
      ETCD_ENABLE_V2: "true"
      ALLOW_NONE_AUTHENTICATION: "yes"
      ETCD_ADVERTISE_CLIENT_URLS: "http://etcd:2379"
      ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379"
    volumes:
      - etcd_data:/bitnami/etcd

volumes:
  etcd_data:
    driver: local

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# Enable rate-limiting on a route
curl http://127.0.0.1:9180/apisix/admin/routes/1   -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1'   -X PUT -d '
{
  "uri": "/api/*",
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "127.0.0.1:8080": 1
    }
  },
  "plugins": {
    "rate-limiting": {
      "rate_type": "client_ip",
      "rate": 100,
      "window_size": 60,
      "key": "remote_addr",
      "rejected_code": 429
    },
    "cors": {
      "allow_origins": "https://example.com",
      "allow_methods": "GET,POST,PUT,DELETE",
      "allow_headers": "Authorization,Content-Type",
      "max_age": 3600
    },
    "prometheus": {}
  }
}'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// Go plugin for APISIX external runner
package main

import (
    "github.com/api7/ext-plugin-go"
    pkgHTTP "github.com/api7/ext-plugin-go/pkg/http"
)

type MyPlugin struct{}

func (p *MyPlugin) Filter(conf []byte, r pkgHTTP.Request) *pkgHTTP.Response {
    // Custom authentication logic
    token := r.GetHeader("X-Custom-Token")
    if token == "" {
        return &pkgHTTP.Response{
            StatusCode: 401,
            Body:       []byte("missing token"),
        }
    }
    return nil // Pass through
}

func main() {
    extPlugin.PluginRunner.Run(extPlugin.NewPluginRunner(
        extPlugin.RegisterFilter(&MyPlugin{}),
    ))
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

version: "3.8"
services:
  envoy:
    image: envoyproxy/envoy:v1.30
    volumes:
      - ./envoy.yaml:/etc/envoy/envoy.yaml:ro
      - ./wasm-filters:/etc/envoy/wasm-filters:ro
    ports:
      - "8080:8080"
      - "8001:8001"

  wasm-compiler:
    image: rust:1.75
    volumes:
      - ./wasm-filters/src:/app:ro
    command: cargo build --target wasm32-wasi --release

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# envoy.yaml
static_resources:
  listeners:
  - name: main_listener
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 8080
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          http_filters:
          - name: envoy.filters.http.wasm
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
              config:
                name: "custom_auth"
                root_id: "custom_auth"
                vm_config:
                  runtime: "envoy.wasm.runtime.v8"
                  code:
                    local:
                      filename: "/etc/envoy/wasm-filters/custom_auth.wasm"
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: backend_service
    connect_timeout: 5s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: backend_service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: backend
                port_value: 8080

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// Custom WASM filter in Rust
use proxy_wasm::traits::*;
use proxy_wasm::types::*;

struct MyAuthFilter;

impl HttpContext for MyAuthFilter {
    fn on_http_request_headers(&mut self, _num_headers: usize, _end_of_stream: bool) -> Action {
        if let Some(token) = self.get_http_request_header("Authorization") {
            if token.starts_with("Bearer valid-") {
                return Action::Continue;
            }
        }
        self.send_http_response(
            401,
            vec![("WWW-Authenticate", "Bearer")],
            Some(b"Unauthorized"),
        );
        Action::Pause
    }
}

impl Context for MyAuthFilter {}

proxy_wasm::main! {{
    proxy_wasm::set_log_level(LogLevel::Trace);
    proxy_wasm::set_http_context(|_, _| -> Box<dyn HttpContext> {
        Box::new(MyAuthFilter)
    });
}}