Release: Gateway 3.16

[lena-larionova]

Release roll-up & preview PR for Gateway 3.15

New features

Plugin ordering

New opt-in priority_preserving dynamic plugin ordering algorithm, alongside the existing algorithm (now named legacy)

• New: priority-preserving ordering
• New: legacy ordering (renamed/contrast page)
• Plugin entity reference: plugin_ordering_algorithm config param

Metrics PDK for custom plugins

New kong.metrics PDK namespace for custom plugins to register counters, gauges, and histograms

• Metrics PDK reference
• How-to: Add metrics to a custom plugin
• Custom plugins reference (related resources link)
• Sandboxing: kong.metrics.* PDK allowlist

OpenTelemetry metrics

Identity attributes on request/bandwidth metrics, custom PDK metrics export, and new stream/data-plane-connection metrics

• Identifying requests in metrics (Principal/Consumer attributes)
  • Example
• Custom metrics (PDK metrics export via OTEL plugin)
• New metrics data (3.16): stream/TCP session metrics, kong.dp.connection.last_seen, kong.dp.config_hash, kong.dp.version.compatible

Principal-aware caching

Cache by authenticated Principal instead of Consumer

• Proxy Cache: Cache by Principal
  • Example
• Proxy Cache Advanced: Cache by Principal
  • Example
• Related: kong.client.get_principal added to the PDK sandboxing allowlist

Log-only / tap mode for validation and threat-protection plugins

Shared "tap mode" behavior: log a warning and proxy instead of blocking

• JSON Threat Protection: log-only mode
• Request Validator: Log request validation failures
  • Example: tap mode

Kafka / Confluent schema registry

Accept plain JSON for Avro schemas instead of Avro's type-tagged union wire format (payload_encoding: simple_json)

• Confluent: Accept plain JSON for Avro schemas
  • Example
• Kafka Log (example)
• Kafka Upstream (example)

Dynamic log levels for data planes

New Admin API / Konnect API endpoints for setting a temporary, TTL-based log-level override on hybrid-mode data planes (10-3600s, default 600s)

• Configure log levels dynamically
• Dynamic log levels for data plane nodes

Konnect analytics opt-out

New analytics_enabled=off config option to disable analytics/telemetry only, while keeping Consumer sync, licensing, config sync, and error reporting active

• FAQ: Disable analytics collection

Dynamic plugin configuration with CEL

New "expressible fields" mechanism: specific plugin config fields can be computed per request via CEL instead of only gating whole-plugin execution, with a static fallback value

• Dynamic plugin config with CEL (reference)
  • How-to: Configure dynamic plugin config with CEL
• ACL: dynamic allow/deny rules (allow_when/deny_when)
  • Example: allow when Principal metadata
  • Example: deny when Principal metadata
• Rate Limiting: rate limit by Principal + CEL config
  • Example
• Rate Limiting Advanced: rate limit by Principal + CEL config
  • Example
• Custom plugins: making a schema field expressible + security guidance
• CEL reference restructured into three pages: CEL expressions reference (syntax), Conditional expressions for plugins (the condition field, moved from the old expressions.md), and the new expressible-fields page above

Route by Kong Identity Principal metadata with Datakit

New how-to using Kong Identity Principals to dynamically set upstream host/scheme per authenticated caller, without a decK sync

• How-to: Dynamically set host based on the authenticated Principal with Datakit
• Datakit: kong.client.principal property + sign-principal-JWT example

Datakit: verify call nodes against a custom CA

call nodes can now verify TLS against a private CA (config.ca_certificates) instead of only Kong's global trusted CA store, useful for internal services with private-CA-signed certs

• Verify TLS against a custom CA
  • Example
  • How-to guide

Kafka / Confluent message compression

Producer-side compression (compression_type: gzip/snappy/lz4) and transparent consumer-side decompression (including zstd)

• Confluent: Message compression
  • Example
• Confluent Consume: Message decompression
• Kafka Log: Message compression
  • Example
• Kafka Upstream: Message compression
  • Example
• Kafka Consume: Message decompression

Redis OAuth 2.0 authentication

New OAuth 2.0 (client_credentials or password grant) option for Redis Cloud/Enterprise authentication, alongside AWS ElastiCache, Azure Managed Redis, and GCP Memorystore

• Redis Cloud authentication: OAuth 2.0 (shared include, rendered on Basic Auth, Rate Limiting, Response Rate Limiting, and other Redis-backed plugins)

PostgreSQL privileges reference

New least-privilege reference for the PostgreSQL role Kong Gateway needs for migrations, runtime, and admin CLI operations

• PostgreSQL privileges reference

Entitlement Enforcement plugin (Konnect only)

New plugin to block requests based on Metering & Billing entitlements: feature access and usage limits, checked via a two-tier Redis + per-worker cache against the Entitlement Access API. Credit-balance enforcement is not yet implemented (config.credit_balance_required and the NO_CREDIT_AVAILABLE reason code currently have no effect, see breaking-changes/known-issues below)

• Entitlement Enforcement plugin reference
  • Example: enforce entitlements for a feature
  • Example: enforce by header with custom response
• Known issue: credit balance enforcement not yet implemented

OIDC: actor tokens and MCP protected resource metadata

RFC 8693 actor-token support for token exchange (delegation, e.g. an AI agent acting on behalf of a user), and RFC 9728 OAuth 2.0 Protected Resource Metadata for MCP client auth-server discovery

• Token exchange: Actor tokens
  • Example
  • Multi-IdP field support table
• Protected resource metadata
  • Example

Debugger: multi-instance Datakit tracing and new HTTP call spans

Support for distinguishing multiple Datakit plugin instances (base + clones) in traces, plus new spans/attributes for internal HTTP calls

• Datakit debugger: plugin_name, parent_span_id, phase, sources fields
• Debugger spans: kong.io.http.request_uri, kong.io.http.read_resp_body span types
  • New attributes: http.url, kong.3p.external_request_id, proxy.kong.plugin.ref (multi-instance Datakit), plus the two attributes below
• proxy.kong.upstream.address
• tls.client.server_name

Other

• FIPS 140-3 packages now also available on 3.16 (previously 3.14 LTS only)

Updates

• Performance benchmarks: new 3.16 numbers (also corrects historical P95 values for 3.12-3.15 "no plugins, 1 Route" case)
• Platform/package support: 3.16 release added (new debian13, rhel10, ubuntu2604 distro support; latest: true moved to 3.16)
• Breaking changes
• 3.16 changelog

Tooling (not user-facing docs)

• New Claude Code skill: plugin-example, for writing/updating first-party plugin example YAMLs (.claude/skills/plugin-example/)

[netlify]

✅ Deploy Preview for kongdeveloper ready!

Name	Link
🔨 Latest commit	8a382c1
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/6aa9782969a6120008626349
😎 Deploy Preview	https://deploy-preview-7202--kongdeveloper.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
7 out of 9 committers have signed the CLA.

✅ lena-larionova
✅ jijiechen
✅ juliamrch
✅ outsinre
✅ findns94
✅ tonydongkong
✅ akashtjohn
❌ kong-documentation-app[bot]
❌ Icarus9913
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[lena-larionova]

The link checker isn't finding any 404s, it's just being rate-limited.