apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: openapi-plugin-force-https
  annotations:
    kubernetes.io/ingress.class: kong
plugin: force-https
config:
  error_format: openapi
---
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: openapi-plugin-digest-auth
  annotations:
    kubernetes.io/ingress.class: kong
plugin: digest-auth
config:
  redis_host: account-redis.cp9-global.svc.cluster.local
  redis_database: 0
  redis_ssl: false
  redis_ssl_verify: false
  nonce_key: "1234567890123456"
  nonce_iv: "1234567890123456"
  error_format: openapi
---
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: openapi-plugin-rate-limit
  annotations:
    kubernetes.io/ingress.class: kong
plugin: rate-limit
config:
  header_name: x-auth-username
  minute: 500
  fault_tolerant: true
  redis_host: account-redis.cp9-global.svc.cluster.local
  redis_database: 1
  redis_ssl: false
  redis_ssl_verify: false
  error_format: openapi
---
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: console-plugin-default-project
  annotations:
    kubernetes.io/ingress.class: kong
# Premium keeps the legacy portal's local RBAC mode because its Dedicated
# allow-list dependencies are intentionally absent. Org-scoped Serverless
# catalog APIs do not carry projectId, while local RBAC needs one to populate
# the downstream metadata. Add only the CP9 persona's deterministic default;
# request-transformer leaves an explicit projectId unchanged.
plugin: request-transformer
config:
  add:
    querystring:
      - projectId:14400020002