February 2021 Summaries

Zero-trust security is a strategy where no entity is trusted by default, and one method to implement it is through the OpenID Connect API gateway plugin. OpenID Connect, built on OAuth and JWT, facilitates authentication and authorization by verifying user identity and managing session data, reducing the need for repeated API gateway authentication. This standard is widely adopted and allows identity providers to centralize access controls, streamlining the management of user access across systems and minimizing security risks associated with traditional API keys. OpenID Connect supports various flows, including authorization code and client credentials, and can inject relevant user information into upstream services via header claims, enhancing API security without repeated code maintenance. By using the OpenID Connect plugin, developers can more efficiently implement zero-trust principles, accelerating the development of secure upstream services.

APIOps is an approach that applies DevOps and GitOps principles to the API and microservice lifecycle, aiming to automate and streamline the deployment and management of APIs while maintaining quality and compliance. By using tools like Kong Konnect and Insomnia, APIOps enables developers to design, test, and govern APIs autonomously, ensuring consistent quality and reducing manual interventions. This method not only increases deployment speed but also ensures adherence to security and governance standards throughout the API lifecycle. Despite the technological advancements and automation, a successful transition to APIOps requires a cultural shift within organizations to prioritize reuse and collaboration across distributed teams. This shift is crucial for maintaining consistency and maximizing the value of digital services, especially in the context of rapidly evolving digital experiences driven by global challenges like COVID-19.

Kuma version 1.0.8 has been released, featuring new health checking capabilities, including support for jitter and custom strings, as well as enhancements to the GUI, CNI, and VM functionalities. Users are encouraged to upgrade to this version by consulting the Upgrade Guide. This release is part of the CNCF Sandbox project, which emphasizes neutrality, openness, and inclusivity. Users can engage with the Kuma community through official Slack channels and community calls, with the next call scheduled for March 3rd. Additionally, following Kuma on Twitter and starring it on GitHub are recommended for staying updated.

Jeremy Justus and Ross Sbriscia, senior software engineers at UnitedHealth Group/Optum, discuss the effectiveness of using the open-source Kong Gateway for API management in a large enterprise setting, detailing their transition from a closed-source to an open-source model. They emphasize the importance of cultivating internal experts, participating in the open-source community, and contributing back to it as key strategies for leveraging open-source platforms like Kong. Through active community engagement and collaboration, they were able to resolve complex technical issues quickly and effectively, highlighting how open-source models enable faster problem-solving and innovation compared to traditional closed-source approaches. Their experience illustrates how embracing open source can lead to operational improvements and increased confidence in managing mission-critical applications within a large enterprise.

As organizations increasingly prioritize application security, the Kong Gateway JWT plugin offers a streamlined approach to API gateway authentication, leveraging JSON Web Tokens (JWT) for secure and efficient credential verification. JWTs facilitate secure data exchange between parties by allowing users to present an access token signed by a trusted party, which is then authenticated by the plugin to grant or deny access to resources. The Kong Gateway acts as a decoupled API gateway that manages authentication, traffic control, and request transformation between users and microservices, with the JWT plugin serving as an authorizer that verifies token authenticity. This approach contrasts with OAuth 2.0 by providing a different authentication method where tokens are not encrypted but rely on token authenticity assured by a trusted signature. By utilizing Kong’s open-source platform and the JWT plugin, developers can focus on core project needs while benefiting from a tested framework that simplifies authentication, enhances security, and supports scalability for microservices architectures. Advanced use cases include granular user authentication, selective route protection, and public/private key configurations, offering flexibility for various application requirements.

Kong has announced the general availability of Kong Gateway 2.3, introducing a "free" operating mode for its Enterprise version, previously exclusive to paying customers. This release includes several enhancements such as a user interface called Kong Manager for easier configuration and additional bug fixes and testing. New features include support for UTF-8 characters, improved plugin capabilities, and simplified license management, allowing licenses to be applied only to the Control Plane and distributed to connected Data Planes. Existing Kong customers still need a paid Konnect license to access certain Enterprise features, and the terminology will shift from "Enterprise" to "Kong Gateway" to reduce confusion. The update also brings new plugin configurations, enhanced logging capabilities, and improved compatibility checks between control and data planes, with further details available in the Kong Gateway 2.3 Changelog.

Kuma version 1.0.7 has been released, featuring enhancements such as support for service-less pods and Kubernetes jobs, new charts in its embedded GUI, and performance improvements in multi-zone and DNS resolutions. Users are encouraged to upgrade and can find a detailed list of updates in the changelog. Kuma, a CNCF Sandbox project focused on being neutral, open, and inclusive, invites community engagement through a community call on February 17th and various community channels, including Slack. It is recommended to consult the Upgrade Guide before installing the new version.

The text discusses the importance of implementing zero-trust security in modern applications, particularly in microservices architectures, by drawing an analogy with passport checks at airports to highlight the need for identity verification. Zero-trust security is crucial as it eliminates the reliance on trust, which can be exploited, especially when dealing with numerous services in a microservice setup. The text emphasizes using service meshes, such as Kuma or Kong Mesh, to enforce zero-trust security by providing virtual "passports" or identities for services, thus ensuring secure communication through mutual TLS and traffic permissions. It describes how service meshes simplify the process by automating the creation and management of certificates and identities, allowing application teams to focus on development while infrastructure architects handle security. Kuma, an open-source service mesh, is highlighted for its ability to enforce zero-trust security across different environments by automatically connecting services and rotating certificates, thus providing a secure and scalable solution for microservice architectures.

Kong has successfully raised $100 million in Series D funding, led by Tiger Global and including new and existing investors, tripling its valuation to $1.4 billion and enabling the company to enhance its cloud-managed service connectivity platform, Kong Konnect. This platform is designed to support cloud-native applications by providing reliable connectivity across various systems from a single control plane. The funding follows a year of significant growth for Kong, marked by an increase in Global 2000 clients and a tripling of its SMB to mid-market customer segment. The company’s open-source Kong API gateway has surpassed 220 million downloads, and its universal service mesh, Kuma, has seen a substantial increase in active instances. Kong's tools, including the Insomnia API testing tool, are widely used by API developers. As digital experiences become mainstream, APIs have emerged as the most efficient way to transmit data, representing 83% of web traffic according to Akamai's report. This trend underscores the growing importance of API connectivity, which is central to Kong's mission of enabling secure and reliable digital connections. Looking ahead, Kong is committed to expanding its role in powering digital interactions, anticipating that the demand for cloud services and API-driven connectivity will continue to grow.

UnitedHealth Group's Optum successfully transitioned from a closed-source API gateway to the open-source Kong Gateway to address issues of scalability, performance, and cost-effectiveness. The move aligned with a broader organizational shift towards embracing open-source solutions, which offered greater extensibility and eliminated licensing fees. Optum implemented Kong with a focus on improving DevOps capabilities, integrating security measures, and establishing efficient API gateway patterns. They developed a self-service model using GitHub for efficient customer interactions, significantly reducing manual operations and enhancing developer productivity. The transition resulted in an 85% reduction in gateway overhead and a 90% increase in resource efficiency, drastically lowering operational costs by 95%. The adoption of Kong led to a substantial increase in performance and scalability, with the platform managing over 11,000 proxies and 4.5 billion transactions monthly by 2020, marking a ten-fold growth from 2019.

Kong has announced the general availability of Kong Konnect, a cloud-native service connectivity platform designed to streamline the deployment and management of connected applications in the cloud era. Konnect offers an end-to-end service lifecycle delivered through a hybrid architecture, where the control plane is hosted as a cloud service and data planes can be deployed across various environments by customers. Key features include the Runtime Manager for managing data planes, the ServiceHub for cataloging and reusing services, and the Portal and Vitals for simplifying operations and providing analytics. Konnect aims to enhance the speed and efficiency of service deployment while reducing the operational burden on users, marking a significant step in Kong's cloud strategy. Existing customers and prospects are encouraged to explore Konnect to accelerate their service connectivity initiatives.