March 2021 Summaries

Building a custom Lua plugin for the Kong Gateway involves creating a simple plugin that adds functionality to API services by automatically appending a custom header to responses. Kong Gateway, which operates on OpenResty and extends the NGINX server, allows developers to create plugins that manage requests between clients and services. These plugins can perform a variety of tasks like authentication, logging, rate limiting, and more, offering enhanced API management capabilities. Developers can use the Kong Plugin Development Kit and tools like Pongo to set up their environment, write, and test plugins efficiently. The tutorial demonstrates how to set up a development environment, write a custom Lua plugin, test it, and use Kong's Admin API to manage services and routes. Additionally, the guide emphasizes the importance of testing and validating plugins using Pongo's testing framework and maintaining clean code with static analysis tools. This enables developers to extend Kong's functionalities while ensuring robust API management solutions.

Many companies are adopting modern software development practices such as DevOps, microservices, and cloud-based CI/CD pipelines, which necessitate robust security measures like zero-trust architectures to protect APIs and control access. Authorization, distinct from authentication, is crucial in this context, particularly in microservices where authorization must be consistently enforced across various components like API gateways, frontends, backends, and databases. There are different approaches to implementing authorization, including hardcoded policies, centralized services, distributed services, and service meshes, each with its own advantages and drawbacks. A service mesh, particularly when integrated with tools like Open Policy Agent (OPA) and Kuma, offers a scalable and consistent authorization solution by enabling network proxies to manage API authorization queries. OPA can be applied across the cloud-native stack for a range of use cases, including controlling CI/CD pipelines, cloud platform resources, and application access. Managing OPA instances in a large-scale service mesh setup can be optimized using control planes such as Styra Declarative Authorization Service (DAS), which offers a policy-as-code solution tailored for enterprise environments and supports various use cases, including Kubernetes and service mesh management.

Kong Mesh 1.2 introduces significant security enhancements, making it the most secure enterprise service mesh by integrating Open Policy Agent (OPA) directly into its framework, allowing seamless implementation of standardized authentication and authorization across Kubernetes and VM environments without additional sidecars. Built on the open-source Kuma, Kong Mesh provides a flexible service connectivity overlay capable of running across multiple clusters and cloud environments, enhancing multi-zone functionality with improved enterprise authentication between global and remote control planes. The update also includes out-of-the-box FIPS 140-2 compliance, ensuring adherence to federal security standards, and automates third-party Certificate Authority support, establishing a zero-trust foundation within organizations. These features enable day-0 security compliance, enhancing organizational security posture, and streamlining operations by addressing previous issues with observability and zero-trust implementation, as described by MS3's CEO, Aaron Weikle. This release aims to fundamentally change service mesh security, reducing the complexity associated with advanced security models while enhancing operational efficiency.

The tutorial provides a comprehensive guide on implementing OAuth2 authorization and authentication using the Kong API Gateway OAuth2 plugin, aimed at ensuring secure and seamless resource sharing between services. It begins by explaining the fundamental concepts of authentication and authorization, along with an introduction to Kong Gateway as an open-source API gateway designed to manage traffic and enhance API security. The tutorial proceeds to illustrate the OAuth2 protocol through a relatable example, highlighting key roles such as resource owner, resource server, and client application. It then guides readers through setting up an API server with Node.js Express, positioning it behind the Kong Gateway, and enabling the OAuth2 plugin to handle authorization requests and token management. The tutorial also details the OAuth2 authorization flow, from obtaining authorization codes to exchanging them for access tokens, and emphasizes the importance of scopes for granular control over resource access. By using Kong Gateway, developers can extend their API servers to also function as authorization servers, streamlining the implementation of secure and efficient authorization protocols across interconnected services.

Insomnia Designer and Insomnia Core have been merged into a single application now simply called Insomnia, following user feedback and internal discussions. This integration means that Insomnia Designer will no longer receive updates, and users must migrate to the new Insomnia, which includes features like a Dashboard for managing request collections, Git Sync, and Unit Testing capabilities. Insomnia Core users will automatically receive updates through the auto-update channel, while Insomnia Designer users will be prompted to migrate their data and settings upon downloading the latest version. The merge is part of a broader strategy to make design functionality a core aspect of Insomnia, promising future enhancements such as request collection grouping, design document management, and improved plugin APIs. This release emphasizes the ongoing commitment to enhancing design capabilities and acknowledges the contributions of those who worked on it.

Kuma is an open-source, CNCF service mesh compatible with various environments, including Kubernetes and virtual machines, designed to simplify the management of service-to-service communications. It provides a built-in CLI, HTTP API, and GUI for managing resources, enabling users to easily deploy and control their service mesh infrastructure. Kuma abstracts the complexity of Envoy, the supporting data plane proxy technology, with native policies but allows low-level customization through proxy templates when needed. It supports multiple deployment modes, including multi-zone and hybrid multi-cloud environments, and facilitates zero-trust security by enabling mutual TLS with minimal configuration. The platform also offers observability features through integrations with Prometheus and Grafana, simplifying the monitoring of service metrics. Additionally, Kuma supports multi-tenancy, allowing organizations to manage multiple compartmentalized meshes under a single deployment, thereby facilitating collaboration among different development teams. The community-driven project also offers enterprise extensions through Kong Mesh, catering to more sophisticated enterprise requirements.

Jeremy Justus and Ross Sbriscia, senior software engineers from UnitedHealth Group/Optum, detail their experience scaling API management with Kong Gateway in a three-part blog series. In 2019, their platform managed 1,900 proxies and 375 million transactions monthly, which grew to over 11,000 proxies and 4.5 billion transactions per month in 2020. This growth required only adding another pod in each environment, showcasing the efficiency of Kong Gateway. They emphasize best practices like creating platform advocates by implementing requested features, enhancing security through mutual TLS, and supporting multiple authentication patterns on a single proxy. They discuss the importance of staying updated with open-source technologies, sharing experiences with upgrades, and handling migration errors. Operational support is critical, with a GitOps-based self-service model complemented by integration consultations and troubleshooting. Governance is highlighted as essential for API management, with a structured ruleset ensuring consistent quality and security across APIs. The overall approach demonstrates how scaling an API ecosystem involves not just capacity expansion but also flexibility, operational support, and governance.