v0.2.0 — hardened config semantics

Closes the findings from an external review. Breaking for some 0.1.0 configs — all three are config-time schema errors with explicit messages, nothing changes silently at runtime:

• https url targets now require an explicit preserve_host. Upstream SNI follows whichever Host preserve_host selects, so the choice must be conscious; with the old default (true) an https target would silently handshake with the client's SNI.
• A templated host must pin a literal :port (e.g. http://$(header.X-Region).internal:8080$(uri)). Otherwise a header value like host.internal:9090 could choose the port on an allowlisted host — internal port-scanning through the gateway. Injected ports are rejected with 503 (asserted e2e).
• preserve_host is rejected on upstream targets, where it was silently ignored.

Also: hostnames may contain underscores (internal DNS), and luacheck joins CI.

Verified: 32 unit tests + 20-case e2e suite against Kong 3.9 (new case: injected port on an allowlisted host → 503).

Upgrade from 0.1.0

• Add preserve_host: true|false to every https url target (you almost always want false).
• Add a literal :port to any url whose host contains a variable.
• Remove preserve_host from upstream targets.

v0.1.0 — first release

First release of dynamic upstream routing for Kong Gateway OSS 3.x.

Highlights

• First-match-wins rules on request headers (exact / PCRE regex / presence)
• Two target modes: Kong Upstream entity, or a templated URL built from $(uri), $(header.*), $(query.*), $(consumer.*)
• SSRF guard enforced twice: schema rejects a templated host without allowed_hosts at config time, and the resolved host is re-parsed and checked against the allowlist at request time (403)
• Fail-closed substitution: unresolved/empty variables return 503, never a mangled URL
• Correct preserve_host semantics, including SNI for https targets (SNI follows the upstream Host header)
• Template query string replaces the client query; otherwise the client query passes through

Verified

• 28 unit tests (plain Lua 5.1, no Kong required)
• 19-case e2e suite against Kong 3.9 DB-less with echo upstreams (e2e/run.sh), both wired into CI

Install

cd plugins/dynamic-upstream
luarocks make kong-dynamic-upstream-0.1.0-1.rockspec
export KONG_PLUGINS=bundled,dynamic-upstream