Apache APISIX 2.9 Release: New authz-casbin Plugin, Dynamic Real-IP Configuration, and Enhanced External Plugin Support

Apache APISIX version 2.9 has been officially released, featuring contributions from over 30 developers and more than 100 pull requests, adding new functionalities and improving plugin support.

New Feature: authz-casbin Plugin

The Casbin community contributed the authz-casbin plugin, enabling fine‑grained, route‑level access control using Casbin’s policy engine. This plugin can be configured via files or the APISIX Control Plane, applying either globally or to specific routes.

New Feature: Dynamic Real‑IP Configuration at Route Level

APISIX 2.9 now supports dynamic configuration of the real-ip plugin per route, allowing the client IP and port seen by APISIX to be altered on the fly.

{
    "plugins": {
        "real-ip": {
            "source": "http_x_forwarded_for",
            "trusted_addresses": ["127.0.0.0/24"]
        }
    }
}

Improvement: External Plugin Mechanism

The release enhances external plugin support in two major ways:

When sending plugin configuration to the Plugin Runner, a unique key is now included, preventing duplicate configuration updates in APISIX’s multi‑process architecture and enabling use cases such as rate‑limiting plugins inside the Runner.

A reverse‑lookup mechanism allows the Plugin Runner to query APISIX for request metadata (e.g., request_time ), which has already been used to implement the Var API in the Go Plugin Runner.

The updated Go Plugin Runner (v0.2.0) will be released next week.

Improvement: Enriched Existing Plugin Capabilities

Two existing plugins received major upgrades:

The request-id plugin now supports ID generation via the Snowflake algorithm, leveraging etcd to assign unique machine IDs to workers.

The error-log-logger plugin can now report error logs to SkyWalking, enhancing observability.

Download

You can obtain Apache APISIX 2.9 from the following sources:

Source code: https://apisix.apache.org/downloads/

Binary packages: https://apisix.apache.org/zh/docs/apisix/how-to-build/

About Apache APISIX

Apache APISIX is a dynamic, real‑time, high‑performance open‑source API gateway offering load balancing, dynamic upstreams, canary releases, circuit breaking, authentication, and observability. It helps enterprises securely manage API and microservice traffic across gateways, Kubernetes Ingress, and service meshes.

Hundreds of global enterprises—including NASA, the European Union’s Digital Factory, China Mobile, Tencent, Huawei, Weibo, NetEase, and many others—rely on APISIX for critical workloads. With over 200 contributors, the project invites developers to join its vibrant community.