May 2021 Summaries

Kong celebrated its sixth anniversary, marking a year of significant growth and development for its open-source API management platform, Kong Gateway. Over the past year, the platform saw exponential increases in product usage, with over 1.7 million instances running globally and more than 257 million downloads. The community supporting Kong Gateway has also more than doubled in size, with key code and content contributors playing pivotal roles in its expansion. Since the last anniversary, Kong has released several new features, including JavaScript PDK, UTF-8 character support, UDP support, and enhanced security measures, among others. These advancements have helped strengthen Kong's position as the most popular API gateway, with widespread adoption across various industries, and the platform continues to benefit from a robust and engaged open-source community. As Kong moves forward, it aims to innovate and challenge the existing norms in API infrastructure, driven by ongoing contributions and feedback from its community.

President Biden's Executive Order 14028, issued on May 12, 2021, aims to bolster the United States' cybersecurity measures by mandating the adoption of Zero-Trust Architecture (ZT) among federal agencies. This architecture is designed to enhance IT system security by eliminating implicit trust and requiring continuous verification of trust, thus offering a more robust alternative to traditional network-based perimeter security. The executive order emphasizes the need for encrypted communications, minimal permissions based on identity, and comprehensive monitoring and logging to ensure the confidentiality and integrity of data. The blog post further outlines five strategies for adopting ZT, highlighting the importance of segmentation, encryption, minimal permissions, logging, and a phased transition approach. It underscores the role of technologies like Kong Gateway and Kong Mesh in facilitating this transition, while advocating for a gradual implementation of ZT practices to improve cybersecurity resilience across organizations.

decK version 1.7.0 introduces new features for enhancing configuration management with Kong Gateway, including the ability to convert on-premises configurations into a format compatible with Konnect, facilitated by the new deck convert command. This release supports Konnect globally with the introduction of the –konnect-addr flag, allowing users to connect to any Konnect instance worldwide. Additional features include the ability to manage service documents and OpenAPI specifications declaratively, improving the practice of APIOps with Kong. Quality-of-life improvements such as default HTTP request timeouts and better sort order for dump entities are included, alongside enhanced security measures for handling sensitive information using environment variables prefixed with "DECK_". These updates aim to streamline gateway configuration while maintaining data security, with the full list of changes available in the changelog. Users can download decK 1.7.0 for various operating systems from the GitHub releases page.

In the second tutorial of the Kong and Okta series, the focus is on implementing the authorization code flow for user authentication using the OpenID Connect (OIDC) plugin with Kong Konnect and Okta. The process involves setting up an authorization code flow where users are redirected to Okta for authentication and returned to Kong with an authorization code token. This token is then validated and exchanged for an identity token via Okta's token endpoint. The tutorial guides users through configuring services and routes in Konnect, setting up an Okta application, and applying the OIDC plugin to protect routes. Testing involves redirecting users to Okta for credential verification and ensuring successful authentication before consuming the API. Additional guidance is offered for protecting applications using Kong Konnect and Okta, with references to further tutorials on API gateway governance and security.

Kong Konnect API Cloud Platform offers robust support for Hybrid deployments, enabling distributed API Gateway Clusters across multiple environments simultaneously, with a distinct separation of Control Plane (CP) and Data Plane (DP) functionalities. The platform provides numerous features including Kong Gateway Enterprise modules and plugins that enhance its functionality, a RESTful Admin API for configuration, and a Kong Dev Portal for developer onboarding and API management. Additionally, Kong Immunity uses machine learning for real-time anomaly detection to enhance security, and Kong Manager provides a GUI for managing routes, services, and plugins. Kong's plug-in architecture supports integration with AWS platforms such as EC2, EKS, and Lambda, and facilitates API lifecycle processes with AWS DevOps services. Moreover, Amazon ECS Anywhere (ECS-A) extends ECS capabilities, enabling Hybrid deployments by allowing ECS tasks to be deployed in any environment, and a reference architecture for implementing a Distributed API Gateway with ECS-A is explored. The infrastructure utilizes AWS Secrets Manager for secure storage of key files and supports enhanced API management with Kong Konnect's extensive plugins, making it easier to run services across multiple platforms.

Kong Gateway's latest release, version 2.4, introduces a JavaScript Plugin Development Kit (PDK), allowing developers to create plugins using JavaScript due to its widespread use and robust library support. This new functionality is demonstrated through the creation of a plugin that adds the X-Clacks-Overhead HTTP header, inspired by Terry Pratchett, to all responses. The environment setup involves running a Node.js server alongside Kong Gateway, with a Docker-based environment provided for ease of use. Plugins are managed through a plugins directory, and the JavaScript PDK simplifies plugin development by automatically providing access to the necessary Kong object. The process includes enabling the plugin via configuration files and testing it locally. Developers can make the plugin behavior customizable through configuration options, such as toggling the X- prefix for headers, demonstrating the flexibility and potential of the new JavaScript PDK in enhancing Kong Gateway's capabilities.

Kong is set to participate in the Gartner Application Innovation & Business Solutions Summit, a virtual event designed to gather application leaders globally to enhance application architecture, development, and integration for composable business. The summit will feature Kong's CTO and Co-Founder, Marco Palladino, who will lead a session discussing strategies for innovation amid transformation, emphasizing the importance of reliability, security, and observability in distributed applications. Attendees have the opportunity to engage with Kong resources at their digital booth and discover insights into crafting an application strategy that meets business needs, with a focus on modernizing applications to drive digital transformation and navigating complex technologies such as microservices and cloud-native architectures. The event also highlights Kong's recognition as a Leader in the 2020 Gartner Magic Quadrant for Full Lifecycle API Management, though Gartner clarifies that its research is opinion-based and not an endorsement of any vendor.

The guide provides a detailed walkthrough on using the Kong Gateway Key Authentication plugin to secure API routes by requiring valid API keys, highlighting the importance of restricting API access for security and resource management. It explains the process of setting up a Node.js Express API server, installing and configuring Kong Gateway with a PostgreSQL database, and using the Kong Admin API to create services, routes, and consumers. The tutorial emphasizes the plugin's ease of use, its configurability to locate API keys in different request parts, and additional features like supporting anonymous access and hiding credentials. By demonstrating how to generate and validate API keys, the guide equips users with the foundational knowledge to apply this strategy to their unique projects, ensuring secure and efficient API management.

API versioning, a critical aspect of implementing API gateways, can be managed through URI and header-based methods, both of which are supported by Kong, an API management platform. The blog focuses on RESTful APIs documented with the OpenAPI specification, excluding other protocols like gRPC and GraphQL. It demonstrates how Kong manages API versions using Routes and provides examples using Insomnia to create OpenAPI specifications for different versions of an Order API. The Kong Dev Portal allows for content-level permissions management, facilitating role-based access and lifecycle management of API versions. The blog also covers implementation guidelines for routing requests to the correct version of an API, using URI-based versioning with URL rewriting and header-based versioning. The Konnect ServiceHub acts as a central API repository, incorporating versioning features for service packages, and the decK tool helps migrate configurations between different setups. The blog concludes with an invitation to explore further tutorials and features offered by Kong for API governance and protection.

Containerization and orchestration are rapidly gaining traction, with the global container market projected to surpass $5 billion by 2026, highlighting a shift from virtual machines (VMs) to platforms like Kubernetes. Companies such as Papa John's leverage tools like Kong Gateway to facilitate connectivity and manage transitions from VMs to Kubernetes, using the Kong Ingress Controller for enhanced API management and security. A tutorial demonstrates this transition process by containerizing a Python Flask application and deploying it on Kubernetes using tools like Docker and Minikube. The guide outlines steps for creating a Dockerfile, building a Docker image, and setting up a local Kubernetes environment with Minikube. It further explores deploying the Kong Ingress Controller to manage ingress security, providing a comprehensive introduction to making applications Kubernetes-native. The process emphasizes the utility of Kong in simplifying management and improving reliability, with the tutorial serving as a practical guide for those transitioning to containerization and Kubernetes orchestration.

The Kong Gateway Rate Limiting plugin is a widely used tool for controlling traffic by setting limits on similar requests, such as those from the same IP address, to prevent server overload and protect against malicious activities like brute force attacks, scrapers, and DDoS attacks. This tutorial details the process of implementing rate limiting using Kong Gateway, starting with creating a simple Node.js Express API server and configuring Kong to act as an API gateway with the Rate Limiting plugin. The tutorial demonstrates configuring request limits on a per-API-key basis and explains the different policies for storing request counters, including local, cluster, and redis options. By using Kong's plugin, users can effectively manage traffic and enhance server protection, with advanced options available for more complex needs. Additional resources and community support are available for users seeking further guidance.

Kong's OpenID Connect (OIDC) plugin facilitates seamless integration between Kong and Okta to address connectivity, authentication, and authorization challenges in application development. By leveraging OAuth/OIDC flows, this integration eliminates the need for app teams to manually configure these elements for each service, allowing more focus on innovation. The tutorial series guides users through implementing service authentication and authorization for Kong Konnect and Okta, starting with the client credentials flow and progressing through authorization code, token validation, and access control. The integration topology includes a control plane for API and policy creation and a data plane for request processing, with implementations on local and AWS EC2 environments using Docker. Setting up a service in Konnect involves establishing routes and applying OIDC policies to control API access, ensuring secure consumption by requiring credentials. Additionally, the OIDC plugin supports upstream header injection to enhance authentication information passed to microservices. The guide encourages users to explore further resources for API gateway governance and security enhancements.

Kong has announced the expansion of its cloud-native service connectivity platform, Kong Konnect, with the introduction of a new plan called Konnect Plus, offering a 30-day free trial and a pay-as-you-go model. This platform enables developers to manage connectivity through API gateways and service meshes while maintaining data traffic separation in their own infrastructure, streamlining application development by providing built-in, secure, and observable connectivity across various cloud environments, including Kubernetes. Additionally, the platform supports decK, Kong's command-line tool for declarative configuration management, allowing developers to manage and automate connectivity logic via a simple web UI. Konnect Enterprise is also expanding globally with the availability of its management plane in regions outside the US, catering to data privacy and compliance needs. This expansion aims to eliminate complexities in operating connectivity runtimes, empowering enterprise architects and developers to accelerate the development of business logic with a single-pane-of-glass management view.

Kong Gateway has become a prominent solution for managing API traffic in microservices architectures, offering both open-source and enterprise support, with user-friendly features. However, configuring it via the Kong Admin API can be error-prone due to the need for multiple curl calls, especially in environments managed by multiple users. A recommended approach is to adopt the GitOps model by storing all configurations in a version control system (VCS) and using a pull request (PR) model to implement changes, thereby simplifying management and enhancing auditability. By integrating GitOps with Terraform as Infrastructure as Code (IAC), users gain advantages like state locking to prevent simultaneous changes, clear change tracking, and efficient error rectification. The article provides a demonstration of configuring Kong using Terraform, detailing steps such as initializing the backend, planning and applying configurations, and verifying changes. Additionally, it suggests using Atlantis to automate Terraform plans and applications in a larger team setting, ensuring that all changes are tracked, audited, and visible as part of a PR-driven workflow.