fix(gateway): add deny-all sentinel to ACL plugin when no consumers exist#277
Merged
Conversation
…xist Kong rejects an ACL plugin with an empty allow list due to schema validation. When no realm defaults, route defaults, or ConsumeRoute resources exist, the allow list was sent as an empty array, causing a 400 error from Kong. Add a '__deny_all__' sentinel group to the allow list when it would otherwise be empty. No real consumer will ever belong to this group, so the plugin is accepted by Kong while effectively blocking all traffic to the route.
ron96g
added
bug
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes Kong schema validation failures when configuring the ACL plugin with an empty allow list by inserting a deny-all sentinel group when no consumers are allowed for a route.
Changes:
- Introduce
plugin.DenyAllGroup("__deny_all__") as a sentinel ACL group constant. - Update
AccessControlFeature.Applyto add the sentinel group when the computed allow-set is empty. - Extend feature builder tests to assert the sentinel is not present when consumers exist and is present when none exist.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
gateway/pkg/kong/client/plugin/acl.go |
Adds exported DenyAllGroup sentinel constant for the ACL plugin. |
gateway/internal/features/feature/access_control.go |
Injects the deny-all sentinel into ACL allow list when no consumers were added. |
gateway/internal/features/builder_test.go |
Adds assertions and a new test covering the empty-consumer (deny-all) behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ron96g
requested review from
ellevaoche,
iagarba,
julius-malcovsky and
stefan-ctrl
ellevaoche
reviewed
Mar 17, 2026
Member
There was a problem hiding this comment.
For me it looks good!
But there is one small question: Is it necessary, that the consumer group "deny_all" is created upfront (one time setup task) via kong admin api?
I think not, because it's not validated by kong if the group really exist. It's only a string in the plugin, right?
ellevaoche
approved these changes
Mar 18, 2026
stefan-ctrl
approved these changes
Mar 18, 2026
dtit-semantic-release Bot
pushed a commit
that referenced
this pull request
Mar 18, 2026
# [0.18.0](v0.17.0...v0.18.0) (2026-03-18) ### Bug Fixes * **common-server:** race-condition and security improvements ([#272](#272)) ([9d08e02](9d08e02)) * **gateway:** add deny-all sentinel to ACL plugin when no consumers exist ([#277](#277)) ([0dd6017](0dd6017)) ### Features * **common-libs:** improve error handling, add feature flags, and fix logger type ([#260](#260)) ([03165a0](03165a0)) * **common-server:** unify latency format in logs ([#267](#267)) ([5fbb19e](5fbb19e)) * **gateway:** add buffering config, dynamic upstream, access control fix, and secret-manager integration ([#259](#259)) ([719c58f](719c58f)) * introduce event-driven communication to the control plane ([#265](#265)) ([f1ed1f5](f1ed1f5)) * **rover-ctl:** add EventSpec handler, env placeholder substitution, and HTTP client improvements ([#264](#264)) ([f15e0f7](f15e0f7)) * **rover-ctl:** support for get-info-many cmd ([#246](#246)) ([1d9f194](1d9f194)) * **secret-manager:** add write strategy support and improve caching ([#263](#263)) ([3f311bf](3f311bf))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Kong rejects an ACL plugin with an empty allow list due to schema
validation. When no realm defaults, route defaults, or ConsumeRoute
resources exist, the allow list was sent as an empty array, causing a
400 error from Kong.
Add a 'deny_all' sentinel group to the allow list when it would
otherwise be empty. No real consumer will ever belong to this group,
so the plugin is accepted by Kong while effectively blocking all
traffic to the route.