June 2021 Summaries

Setting up Kubernetes for the first time presents networking challenges, particularly in safely granting outside clients access to the cluster while maintaining internal communication among pods. To address this, the post explores the use of Kuma, a modern service mesh that integrates with Envoy Proxy, to manage and observe Kubernetes traffic. Kuma enables seamless management of network services, offering capabilities like fine-grained traffic control, rapid metrics analysis, and observability through integration with tools such as Prometheus and Grafana. It supports multi-zone deployments and is compatible with the Container Network Interface (CNI) standard, allowing easy configuration and swapping of network policies. Kuma simplifies the setup of traffic rules using a YAML DSL for defining Traffic Permission policies, which manage service communication and isolate certain microservices from external networks. With its ability to act as a service mesh, observability platform, and network policy manager, Kuma provides a comprehensive solution for secure and efficient network management in Kubernetes, supporting a zero-trust security model and guidelines for defining networking policies.

The text explores the shift from monolithic to distributed models, emphasizing the pervasive impact of distribution on both businesses and applications. It draws an analogy between moving homes and transitioning to distributed architectures, highlighting the complexities and advantages of gradual, efficient changes. Kong Konnect is introduced as a solution that facilitates this transition by providing API gateway and service mesh functionalities, enabling seamless integration between monolithic and microservices architectures across multi-cloud and hybrid environments. This connectivity allows companies to maintain legacy applications while gradually embracing cloud-native solutions, optimizing resource allocation from maintenance to innovation. The text also promotes an upcoming webinar aimed at demonstrating the deployment of Kuma and Kong Mesh for consistent application connectivity in multi-cloud settings.

The tutorial series on integrating Kong Konnect with Okta focuses on implementing service authentication and authorization using the OpenID Connect (OIDC) plugin, specifically detailing how to set up a basic access control policy based on Okta groups and claims. It explains how to utilize OIDC claims and scopes to control access, where a claim based on an Okta group is defined and included in all scopes, allowing only users within that group to access specific Kong routes. The tutorial demonstrates configuring Okta with users and groups, creating a new claim, and enabling the OIDC plugin to ensure only tokens containing the specified claim can consume the route. The process involves testing access with users to verify whether their tokens possess the necessary claims, thus determining their ability to access the route, and concludes by inviting users to start a free trial or explore further tutorials on enhancing their developer pipelines and API management.

Kuma has released a new major update, version 1.2, featuring numerous enhancements and tools designed to improve service mesh functionality, and Kong Mesh has followed suit with a new release built on Kuma. Notable additions include a Layer 7 Traffic Routing policy for more refined HTTP traffic management, a Rate-Limit policy to enhance service reliability, and improved DNS resolution performance. The update also includes renaming of "Remote" control planes to "Zone" control planes and renaming "Ingress" to "ZoneIngress" for clarity. The release updates to Envoy 1.18.3 and addresses issues such as IPv6 support on GCP/GKE. Users are encouraged to upgrade to leverage these improvements and can participate in various community events, such as webinars and livestreams, to further explore the new features and engage with the project community. Kuma is a CNCF Sandbox project, emphasizing neutrality and inclusivity, with community calls and channels available for learning and contribution.

Digital transformation has prompted companies to modernize their API technologies, especially those with legacy infrastructures, by adopting Kubernetes and decoupling monolithic systems to handle the high velocity of data flowing through APIs. A key strategy involves using API gateways, such as the Kong Ingress Controller, which serves as a central entry point in microservice architectures, routing requests to appropriate backend services, and managing policy concerns like authentication and rate limiting. This tutorial illustrates setting up a Kubernetes cluster on DigitalOcean, deploying dummy microservices, and configuring Kong to route API calls, all while highlighting the importance of choosing a gateway compatible with both on-prem and cloud services. Kubernetes is increasingly favored for hosting distributed architectures due to its auto-scaling and fault tolerance capabilities, and Kong, integrating well with other CNCF projects, offers an easy setup, zero-downtime updates, and a rich plugin ecosystem. The article emphasizes the vital role of API gateways in simplifying the development and maintenance of microservices, allowing development teams to focus on business logic, and provides a step-by-step process for deploying and configuring the Kong Ingress Controller, along with considerations for managing resources and minimizing costs.

Kong Dev Portal offers a RESTful API-based catalog and YAML-based template functionality, which can be enhanced using GraphQL to create a more interactive API documentation experience. The tutorial guides users through setting up a dynamic and interactive API documentation platform using Kong Konnect Enterprise, a Star Wars API endpoint, and GraphiQL, an open-source tool for GraphQL documentation. Users are shown how to create a template, integrate content, and set up a GraphQL interface that allows for interactive browsing, autocomplete, and multivariable support, all with minimal coding effort. The tutorial demonstrates creating a functional GraphQL endpoint within a browser, adjusting URLs dynamically, and enhancing the portal's navigation to include links to the interactive documentation. The process highlights the potential for further customization, including authentication and role-based access control, and encourages users to explore additional tutorials for advanced setup and integration.

The third installment of the Kong and Okta tutorial series focuses on implementing the introspection flow, a crucial part of service authentication and authorization using the OpenID Connect (OIDC) plugin. This tutorial demonstrates how to integrate Kong Konnect and Okta, leveraging the introspection flow to validate tokens during request processing. The process involves Kong Gateway evaluating tokens through a specific Okta endpoint to determine their validity, with caching capabilities available in production environments but disabled here for educational purposes. The tutorial details setting up an Okta application with client credentials, configuring the OIDC plugin with specific parameters, and using Insomnia to test the introspection flow by sending requests to both Okta and Konnect. It also highlights the effects of deactivating the Okta application, which renders associated tokens invalid, and provides guidance on protecting applications with Kong Konnect and Okta, encouraging users to explore related tutorials for further automation and service design insights.

Razorpay developed a custom Lua plugin for Kong Gateway to streamline PCI compliance, focusing on minimizing the exposure of sensitive card information to meet PCI-DSS standards. The Payment Card Industry Data Security Standard mandates companies to create secure systems that process, store, or transmit card data, requiring annual audits for certification. To achieve this, Razorpay uses a tokenization service, which replaces card data with unique tokens, reducing the number of components exposed to raw card information. The custom plugin, known as the PCI Handler Plugin, introspects payloads for card data, validates input, and facilitates tokenization, transforming payloads by replacing card attributes with tokens. The implementation involves configuring Kong to manage the plugin and setting up tokenization and upstream services. This architecture, leveraging Kong's plugin system, enhances security by narrowing the PCI scope and supports the scalability of Razorpay's microservices while maintaining compliance.

As enterprises increasingly shift from monolithic to microservices architecture to enhance application development and innovation, they encounter unique security challenges primarily due to the complexity of managing numerous distributed components communicating via APIs. Traditional security approaches prove inadequate because each microservice may have distinct security requirements. Kong Konnect offers an end-to-end service connectivity platform that addresses these challenges by providing universal service connectivity, management, and a multi-layered defense strategy. It includes the Kong API Gateway and Kong Mesh, which facilitate security practices like zero-trust and GDPR compliance, while offering powerful authentication and security plugins such as Open ID connect and mutual TLS authentication. These features ensure secure and reliable API interactions, protect against unauthorized access, and maintain data privacy and protection in compliance with standards like SOC 2, Type 2. This enables enterprises to transition to microservices without compromising on security, thereby supporting their digital transformation efforts.

Multi-cloud infrastructure is revolutionizing software architecture by evolving from gateway traffic management to full lifecycle API management, as explored in a blog series with Reza Shafii, Kong's VP of product. The initial focus is on containerization in a cloud-native context, owing to its cost-saving, platform-agnostic, and scalable nature, which supports microservices strategies and provides flexibility without vendor lock-in. Containers allow applications to be easily broken into microservices, facilitating faster changes and cost savings, akin to a Tetris game optimizing compute capacity with Kubernetes. However, legacy technologies face limitations in this containerized world, as they require manual state changes, unlike Kong Gateway, which offers dynamic, declarative configuration-driven change management, enabling seamless scaling in environments like Kubernetes. This approach is crucial for cloud connectivity, ensuring secure, reliable, and scalable communication between application components, highlighting Kong's unique position in addressing full lifecycle API management in a cloud-native, multi-cloud, and microservices-driven landscape.

Kong Gateway and Kuma or Kong Mesh create a powerful combination for enhancing connectivity in service mesh environments by allowing any API gateway to serve as an entry point into the service mesh. In this setup, Kong Gateway acts as a versatile API gateway that can be deployed across various environments such as public clouds, virtual machines, and Kubernetes, while offering extensive functionality through its plugin marketplace. Kuma and Kong Mesh, which are based on Envoy, provide advanced features for traffic routing, security, and observability by moving connectivity logic into sidecar proxies, facilitating a decentralized communication model. The Kong Ingress Controller (KIC), designed for Kubernetes, simplifies the integration with service meshes by acting as a gateway with pre-configured settings. This synergy between Kong Gateway and Kuma/Kong Mesh results in a highly flexible and functional system for managing end-to-end connectivity, allowing users to leverage existing tools and infrastructure for enhanced security and automation in application communications.

Acme, a large bank undergoing digital transformation, faces significant challenges in managing its sprawling tech landscape, characterized by legacy systems and siloed engineering teams. The bank's efforts to migrate to the cloud and adopt a consistent API and microservices-driven approach are hampered by manual processes and inconsistent standards, leading to inefficiencies, high costs, compliance issues, and security risks, as exemplified by a data breach affecting 15 million customer accounts. The API Platform team is overwhelmed by the volume of new APIs needing review, resulting in delays and decreased morale, while the Mobile team, in a rush to release a new Open Banking application, bypasses governance processes, leading to inconsistent and hard-to-use APIs. Acme's struggles highlight the need for APIOps, an approach that automates the full API lifecycle by incorporating DevOps and GitOps philosophies to enhance speed, quality, and scalability, ensuring the organization can innovate sustainably and effectively leverage APIs as business enablers.

APIOps is an approach that automates the entire API lifecycle by integrating DevOps and GitOps, enhancing productivity through API reuse. The tutorial explores setting up an end-to-end automation framework using Kong Konnect and its declarative configuration tool, decK, which allows users to capture, update, compare, and synchronize API configurations in a CI/CD framework. The process involves capturing the current state of Konnect configurations, updating them, comparing changes, and synchronizing updates to maintain consistency and governance. The tutorial demonstrates examples such as changing a plugin configuration and updating rate limits, emphasizing the benefits of using decK to streamline API management and governance processes while maintaining integration with existing change management systems. By doing so, users can improve governance, consistency, and stability in deploying API services, ultimately enhancing productivity and reducing manual processes.