Combining Global and Route-Specific Plugins in ApisixRoute

[sopacifics]

Hi APISIX Team,

We are currently facing an issue when trying to combine the use of plugin_config_name with inline plugins definitions within a single ApisixRoute resource. Our goal is to have a global plugin (for example, an OIDC configuration) applied to multiple routes, while still allowing route-specific plugins (such as proxy-rewrite) to be defined inline without repeating the global configuration on every route.

Scenario:

• Not Working (Using Both plugin_config_name and inline plugins):

  apiVersion: apisix.apache.org/v2
  kind: ApisixRoute
  metadata:
    name: nginx-route
    namespace: api-gateway
  spec:
    http:
    - name: nginx-rule
      match:
        paths:
          - /nginx/*
      plugins:
      - name: proxy-rewrite
        enable: true
        config: 
          regex_uri:
          - "^/nginx/(.*)"
          - "/$1"
      backends:
      - serviceName: nginx-service
        servicePort: 80
      plugin_config_name: oidc-global

  In this configuration, only the plugins defined in the referenced ApisixPluginConfig (nginx-oidc-global) are applied. The inline proxy-rewrite plugin is ignored.

• Working (Defining All Plugins Inline):

  apiVersion: apisix.apache.org/v2
  kind: ApisixRoute
  metadata:
    name: nginx-route
    namespace: api-gateway
  spec:
    http:
    - name: nginx-rule
      match:
        paths:
          - /*
          - /nginx/*
      plugins:
      - name: proxy-rewrite
        enable: true
        config: 
          regex_uri:
          - "^/nginx/(.*)"
          - "/$1"
      - name: openid-connect 
        enable: true
        config:
          client_id: "**********************************"
          client_secret: "**********************************"
          discovery: "https://sso-**********************************"
          redirect_uri: "http://**********************************/"
          scope: "openid profile"
          bearer_only: true
          introspection_endpoint_auth_method: "client_secret_basic"
          realm: "master"
      backends:
      - serviceName: nginx-service
        servicePort: 80

In this case, both the OIDC and proxy-rewrite plugins are applied, but I need to repeat the OIDC configuration in every ApisixRoute.

Question:

Is there any supported way to combine a global plugin configuration (such as openid-connect via plugin_config_name) with additional route-specific plugins (like proxy-rewrite) in a single ApisixRoute resource without having to duplicate the global configuration on each route? If not, is the recommended approach to handle this scenario?

We’d appreciate any guidance or workarounds you might suggest for this scenario.

Thanks in advance for your help!

Best regards,

Sofia

[dosubot[bot]]

Hey @sopacifics! I'm here to help you with any bugs, questions, or contributions. Let's tackle this issue together while we wait for a human maintainer.

Yes, there is a supported way to achieve this in APISIX. You can use the ApisixPluginConfig CRD to extract and reuse commonly used plugins and bind them directly to a route. This allows you to avoid duplicating the global configuration on each route.

When you use plugin_config_name to reference a global plugin configuration, the plugins from the ApisixPluginConfig will be merged with the route's inline plugins. However, if the same plugin is defined both in the global configuration and inline, the inline configuration will not override the global one.

Here's an example of how you can configure this:

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: nginx-route
  namespace: api-gateway
spec:
  http:
  - name: nginx-rule
    match:
      paths:
        - /nginx/*
    plugin_config_name: nginx-oidc-global
    plugins:
    - name: proxy-rewrite
      enable: true
      config: 
        regex_uri:
        - "^/nginx/(.*)"
        - "/$1"
    backends:
    - serviceName: nginx-service
      servicePort: 80

In this setup, the proxy-rewrite plugin is added specifically for the route, while the global OIDC configuration from the nginx-oidc-global Plugin Config is applied to the route. This way, you can combine global and route-specific plugins without duplicating the global configuration on each route ^[1][2][3].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[sopacifics]

@dosu Thank you so much, that works! However, I have another scenario: I need two global OIDC configurations—one for M2M (with bearer_only: true) and one for a web app (with bearer_only: false). Since plugin_config_name doesn’t support more than one plugin name, is creating two separate routes the best approach, or is there an alternative solution to support both configurations globally? by the way, is there any plan for plugin_config_name attribute to support more than one plugin? In advance, thanks!

[dosubot[bot]]

Currently, the plugin_config_name attribute in APISIX does not support multiple plugin configurations. To handle scenarios where you need different global configurations, such as one for M2M and another for a web app, creating separate routes with distinct plugin_config_name references is indeed a practical approach.

As for future support for multiple plugin_config_name attributes, there is no available information or documentation indicating plans to enhance this feature to support multiple configurations ^[1][2][3].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}