Kong custom plugin giving this error upon installation via helm: "plugin is enabled but not installed"

[KDTEC]

I installed kong in hybrid mode in my kubernetes cluster via helm and it is working perfectly fine.

I wanted to create a custom lua plugin but upon installation i am getting the below error:

This is my control plane configuration:

  values:
    ingressController:
      enabled: true
      ingressClass: kong-dev
      resources:
        limits:
          cpu: 200m
          memory: 256Mi
        requests:
          cpu: 100m
          memory: 128Mi
      installCRDs: false
      env:
        publish_service: default/kong-dp-kong-proxy
        kong_admin_token:
          valueFrom:
            secretKeyRef:
              name: kong-manager-password
              key: password
    image:
      repository: kong/kong-gateway
      tag: 3.7.1.2
    secretVolumes:
      - example-certificate
      - kong-ca-cert
    env:
      role: control_plane
      cluster_cert: /etc/secrets/example-certificate/tls.crt
      cluster_cert_key: /etc/secrets/example-certificate/tls.key
      database: postgres
      pg_database: postgres
      pg_user: '${postgres.postgres-kong.out.interfaces.reader.username}'
      pg_password: '${postgres.postgres-kong.out.interfaces.writer.password}'
      pg_host: '${postgres.postgres-kong.out.interfaces.writer.host}'
      pg_ssl: 'on'
      password: admin
      nginx_http_ssl_protocols: TLSv1.2
      lua_ssl_verify_depth: 3
      cluster_mtls: pki
      cluster_ca_cert: /etc/secrets/kong-ca-cert/ca-cert.pem
      pg_schema: ''
      admin_gui_url: 'https://kong-manager-dev.example.com'
      admin_gui_api_url: 'https://kong-admin-dev.example.com'
      admin_gui_ssl_cert: /etc/secrets/example-certificate/tls.crt
      admin_gui_ssl_cert_key: /etc/secrets/example-certificate/tls.key
      admin_ssl_cert: /etc/secrets/example-certificate/tls.crt
      admin_ssl_cert_key: /etc/secrets/example-certificate/tls.key
      portal_gui_ssl_cert: /etc/secrets/example-certificate/tls.crt
      portal_gui_ssl_cert_key: /etc/secrets/example-certificate/tls.key
      portal_api_ssl_cert: /etc/secrets/example-certificate/tls.crt
      portal_api_ssl_cert_key: /etc/secrets/example-certificate/tls.key
      portal_auth: basic-auth
      portal_api_url: 'https://kong-portalapi-dev.example.com'
      portal_gui_url: 'https://kong-portal-dev.example.com'
      portal_gui_host: kong-portal-dev.example.com
      portal_gui_protocol: https
      portal_session_conf:
        valueFrom:
          secretKeyRef:
            name: kong-session-config
            key: portal_session_conf
      user: kong
      plugins: bundled,custom-token-validation
      lua_package_path: /opt/kong/plugins/?.lua;;
    enterprise:
      enabled: true
      license_secret: kong-enterprise-license
      vitals:
        enabled: true
      rbac:
        enabled: true
        session_conf_secret: kong-session-config
        admin_api_auth: basic-auth
      portal:
        enabled: true
      smtp:
        enabled: false
    admin:
      enabled: true
      http:
        enabled: false
      type: LoadBalancer
      annotations:
        konghq.com/protocol: https
      labels: {}
      tls:
        enabled: true
        servicePort: 443
        containerPort: 8444
        parameters:
          - http2
      ingress:
        annotations:
          kubernetes.io/ingress.class: kong-dev
          konghq.com/https-redirect-status-code: '301'
          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
        enabled: true
        hostname: kong-admin-dev.example.com
        path: /
        tls: example-certificate
    cluster:
      enabled: true
      tls:
        enabled: true
        servicePort: 443
        containerPort: 8005
      type: LoadBalancer
      annotations: {}
      http:
        enabled: false
      ingress:
        annotations:
          kubernetes.io/ingress.class: kong-dev
          konghq.com/https-redirect-status-code: '301'
          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
        enabled: true
        hostname: kong-cluster-dev.example.com
        path: /
        tls: example-certificate
    clustertelemetry:
      enabled: true
      tls:
        enabled: true
        servicePort: 443
        containerPort: 8006
      type: LoadBalancer
      http:
        enabled: false
      ingress:
        annotations:
          kubernetes.io/ingress.class: kong-dev
          konghq.com/https-redirect-status-code: '301'
          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
        enabled: true
        hostname: kong-clustertelemetry-dev.example.com
        path: /
        tls: example-certificate
    manager:
      enabled: true
      type: LoadBalancer
      annotations:
        konghq.com/protocol: https
      labels: {}
      http:
        enabled: false
      tls:
        enabled: true
        servicePort: 443
        containerPort: 8445
        parameters:
          - http2
      ingress:
        annotations:
          kubernetes.io/ingress.class: kong-dev
          konghq.com/https-redirect-status-code: '301'
          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
        enabled: true
        hostname: kong-manager-dev.example.com
        path: /
        tls: example-certificate
    proxy:
      enabled: false
    portal:
      enabled: true
      type: LoadBalancer
      annotations: {}
      labels: {}
      http:
        enabled: false
      tls:
        enabled: true
        servicePort: 443
        containerPort: 8446
      ingress:
        annotations:
          kubernetes.io/ingress.class: kong-dev
          konghq.com/https-redirect-status-code: '301'
          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
        enabled: true
        hostname: kong-portal-dev.example.com
        path: /
        tls: example-certificate
    portalapi:
      enabled: true
      type: LoadBalancer
      annotations: {}
      labels: {}
      http:
        enabled: false
      tls:
        enabled: true
        servicePort: 443
        containerPort: 8447
      ingress:
        annotations:
          kubernetes.io/ingress.class: kong-dev
          konghq.com/https-redirect-status-code: '301'
          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
        enabled: true
        hostname: kong-portalapi-dev.example.com
        path: /
        tls: example-certificate
    gateway:
      plugins:
        configMaps:
          - name: kong-custom-plugin
            pluginName: custom-token-validation

I mentioned the plugin name in:
plugins: bundled,custom-token-validation

I also mentioned the:
lua_package_path: /opt/kong/plugins/?.lua;;

I also created the configmap and it is mounted at: /opt/kong/plugins/custom-token-validation inside my kong pod

This is how my configmap looks with my handler and schema code:

apiVersion: v1
data:
  handler.lua: |-
    local http = require "resty.http"
    local cjson = require "cjson"

    local CustomTokenValidation = {
      PRIORITY = 1000,
      VERSION = "1.0.0",
    }

    function CustomTokenValidation:access(config)
      -- Extract JWT token from Authorization header
      local jwt_token = kong.request.get_header("Authorization")
      if not jwt_token then
        kong.log.err("No JWT token found in the request")
        return kong.response.exit(400, { message = "No JWT token found" })
      end

      -- Call the external API to validate the JWT token
      local httpc = http.new()
      local res, err = httpc:request_uri("https://api-dev.example.com/auth/realms/v1/validateToken", {
        method = "GET",
        headers = {
          ["Authorization"] = jwt_token,
          ["Content-Type"] = "application/json"
        }
      })

      -- Handle any errors during the request
      if not res then
        kong.log.err("Failed to validate token: ", err)
        return kong.response.exit(500, { message = "Failed to validate token: " .. (err or "unknown error") })
      end

      -- Check the status of the external API response
      if res.status ~= 200 then
        kong.log.err("Token validation failed with status: ", res.status, " and body: ", res.body)
        return kong.response.exit(res.status, res.body)
      end

      -- Parse the response from the external API
      local ok, body = pcall(cjson.decode, res.body)
      if not ok then
        kong.log.err("Failed to decode JSON response from token validation API: ", res.body)
        return kong.response.exit(500, { message = "Invalid response from token validation service" })
      end

      -- Extract externalUserId from the response body
      local externalUserId = body.body and body.body.externalUserId
      if not externalUserId then
        kong.log.err("No externalUserId found in the token validation response")
        return kong.response.exit(500, { message = "Invalid token validation response: missing externalUserId" })
      end

      -- Set the custom header with the externalUserId
      kong.service.request.set_header("x-user-vcpId", externalUserId)
    end

    return CustomTokenValidation
  schema.lua: |-
    local typedefs = require "kong.db.schema.typedefs"

    return {
      fields = {
        { consumer = typedefs.no_consumer },
        { protocols = typedefs.protocols_http },
        { config = {
            type = "record",
            fields = {
              --  add any additional configuration fields here if needed
              -- For example:
              -- { timeout = { type = "number", default = 10000, required = true } },
            },
          },
        },
      },
    }
kind: ConfigMap
metadata:
  creationTimestamp: "2024-10-15T06:30:55Z"
  name: kong-custom-plugin

Pod is not coming up...just getting the error I pasted above.

I am completely struck...please help

[ProBrian]

Hi @KDTEC , can you try the simple example plugin(following https://docs.konghq.com/kubernetes-ingress-controller/latest/plugins/custom/ ) to see if it works? We can first check if its the configuration issue or just your custom plugin issue.

[mfeledyn]

Kong does not find your plugin. The kong/plugin sub directory is implied.
So you may try with:
lua_package_path: /opt/?.lua;;