September 2022 Summaries

Kong Summit 2022 marked a return to in-person gatherings after two years of virtual events, drawing Kong's customers, partners, open-source community, and industry experts to San Francisco to explore API innovation and modern connectivity. The event focused on balancing the advancement of APIs and microservices with security and governance, offering sessions and workshops on real-world solutions for building, securing, consuming, and governing these technologies. Key figures such as Viktor Gamov, Principal Developer Advocate, and Daliya Spasova, Community Manager, were notably present, contributing to the vibrant exchange of ideas and insights.

Kong has been enhancing its collaboration with AWS to improve user experiences by offering Kong Konnect through AWS Marketplace, which simplifies the purchasing and deployment processes for customers using Kong in the AWS cloud. This strategic partnership has led to increased growth in joint solutions, awareness, and adoption of Kong's offerings, marking significant year-over-year growth in the Kong on AWS business. Kong Konnect's availability on AWS Marketplace allows customers to swiftly procure and implement the service, and a Forrester Consulting study highlights the efficiencies and cost savings achieved by organizations using AWS Marketplace for software procurement. Moreover, Kong is offering a free trial of Kong Konnect Enterprise through AWS Marketplace until the end of October. Furthering architectural flexibility, Kong has also collaborated with AWS to validate Kong Gateway's functionality on EKS Anywhere Bare Metal, allowing EKS clusters to run on on-premise bare-metal servers. As a result, Kong has been recognized as an AWS launch partner for this service, underscoring the partnership's role in accelerating digital transformation and application modernization initiatives.

Kong has announced the release of Kong Ingress Controller (KIC) 2.7, which includes enhancements such as the graduation of certain Kubernetes Gateway APIs (GatewayClass, Gateway, and HTTPRoute) to beta status, making them more readily accessible to users. The release also retains some APIs (TCPRoute, UDPRoute, TLSRoute, ReferenceGrant) in alpha, but they can be activated with a specific feature flag. Additionally, KIC 2.7 introduces more granular Prometheus metrics to improve visibility into configuration push failures, distinguishing between conflicts and other errors, and has updated plugin functionality to allow user-defined execution order, enhancing efficiency and security. Looking ahead, Kong aims to keep pace with the Kubernetes SIG group's innovations, with plans to support new features like GRPCRoute and HTTPRouteResponseModifier, and to advance existing alpha APIs to beta. The release promises continued development of the Gateway Operator, a tool for managing and upgrading Kong Gateway and KIC deployments.

Kong has announced a new release of Kong Konnect, its SaaS API lifecycle management platform, featuring enhancements and new capabilities aimed at improving API management across various environments. Key updates include multi-geo support for hosting control planes in the European Union, which aids in meeting data residency and regulatory requirements while reducing network latency. The platform now supports most features of Kong Gateway 3.0, such as OpenTelemetry integration and WebSocket support, with plans to incorporate secret management and consumer group features by year-end. Additionally, Kong Konnect introduces dynamic client registration with Okta integration for application management, enhancing security and streamlining processes for developers. The developer portal now supports application registrations across all runtime groups, and new features in Kong Analytics provide insights into runtime group usage and custom reporting capabilities, enabling users to better visualize and export data. These updates are available to Kong Konnect Enterprise customers, with some features in private beta or tech preview, and further details can be found in the platform's documentation.

Kong Gateway 3.0 marks a significant advancement in the cloud-native API platform, offering enhanced security, flexibility, and performance for both enterprise and open-source editions. The update introduces features like FIPS 140-2 compliance for secure operations, an advanced routing engine for optimized request handling, and extensive tracing support through OpenTelemetry integration. It also provides new WebSocket plugins for frame validation and size limitation, improved secrets management for secure storage of sensitive information, and customizable plugin execution order to suit different organizational needs. Additionally, Kong Manager 3.0 has been revamped for better API management with an intuitive interface and informative dashboards. Notable performance improvements include a 37% increase in throughput and reduced latency, along with the ability to incrementally reload routing configurations. The release also includes several deprecations and removals to streamline functionality, alongside updates like better plugin version alignment and new Docker image bases.

As companies strive to compete in the cloud era, Red Hat OpenShift is a key player in providing a robust platform for developing secure and scalable applications in hybrid and multi-cloud environments. Kong enhances this experience by integrating its API gateway, ingress controller, and mesh solutions with Red Hat's infrastructure, facilitating efficient and secure application delivery. To support evolving customer needs, Kong has introduced its Red Hat Ansible Certified Content Collection, which simplifies the deployment of Kong solutions on OpenShift and Kubernetes by automating complex processes and supporting enterprise-grade deployments. This collection, available through Ansible Automation Hub, enhances system management at scale, streamlines Kubernetes deployment processes, and integrates automation capabilities for cert-manager and external-dns projects, ensuring seamless TLS certificate management and automated DNS configuration.

Implementing API Gateway Authentication (AuthN) and Authorization (AuthZ) is crucial for controlling data access through APIs, as explained through the integration of Kong Gateway Enterprise, Styra Declarative Authorization Service (DAS), and external Identity Providers. AuthN verifies a consumer's identity using credentials, while AuthZ determines access to resources post-authentication. The processes enable context-rich, distributed authorization decisions, adhering to the principle of Separation of Concerns, crucial in cloud-native architectures. In microservices, AuthN is centralized while AuthZ is distributed, with API Gateway layers handling low-granularity policies and service meshes managing high-granularity policies. A reference architecture involves API Gateways, Authentication Servers, and Authorization Servers, with Kong Gateway offering plugins for various AuthN methods and open-source OPA for AuthZ policies. Styra DAS, as the control plane for OPA, provides a consistent authorization framework across environments. The document highlights deploying an example application using Kong, OPA, and Styra DAS, demonstrating flexible, combined AuthN and AuthZ decisions, with detailed steps for configuring policies and systems within Kubernetes environments.

StepZen enables the creation of GraphQL APIs by combining data from various sources, such as REST APIs, databases, and other GraphQL endpoints, to deliver new services, like converting item prices into a user's local currency based on their IP address. Although GraphQL adoption is still behind RESTful APIs, StepZen provides tools like GraphQL Studio to help build, deploy, and manage these APIs. For users more familiar with REST, Kong's degraphql plugin can convert GraphQL APIs back into REST APIs, enhancing accessibility. The process involves deploying the API through StepZen, configuring Kong Gateway for authentication and request proxying, and using plugins to map and transform requests and responses, ensuring seamless integration and user experience. This approach allows for complex API composition and delivery without requiring additional code, leveraging StepZen's materializers and Kong Gateway's capabilities to meet consumer needs efficiently.

Enterprises are prioritizing security best practices amid rising cybersecurity threats, with IT spending projected to increase, particularly in cloud computing and security software. A key trend in digital transformation is the transition from monolithic architectures to microservices, which presents unique security challenges due to a broader attack surface. Traditional security models are insufficient for microservices, necessitating a defense in depth (DiD) strategy that layers multiple protections. This approach encompasses physical, administrative, and technical controls, focusing on securing Kubernetes clusters and containerized microservices in the cloud. Key components include securing cloud accounts, Kubernetes clusters, containers, and code, complemented by tools like API gateways and service meshes to enhance security and offload responsibilities from developers. Kong Enterprise and Kong Mesh are highlighted as enterprise-ready solutions for implementing a robust DiD strategy, facilitating security in cloud-native environments through API management and secure service-to-service communication.

In an exploration of the development process behind Kong's WasmX framework for Nginx, Hisham Muhammad details his journey of integrating support for V8, the JavaScript engine used by Google Chrome, into the system. The narrative unfolds over ten weeks, beginning with Muhammad's onboarding and familiarization with WasmX, and progressing through the technical challenges of adapting V8 to work within the framework alongside existing Wasm virtual machines like WasmTime and Wasmer. The process involved addressing discrepancies in WebAssembly C API implementations, creating a Rust module to facilitate necessary conversions, and tackling the absence of Web Assembly System Interfaces (WASI) in V8. As the project advanced, Muhammad engaged in collaborative efforts to resolve a validation function issue in V8, leading to a successful patch submission. The culmination of this effort was the integration of V8 support within WasmX, verified through thorough testing and continuous integration processes, despite the complexities introduced by differing build environments. This detailed account not only showcases the technical intricacies involved but also highlights the collaborative and iterative nature of software development.

The latest release of Kong Konnect enhances security and compliance through new authentication features, including the introduction of personal access tokens (PATs) and support for federated identity management using OpenID Connect (OIDC). PATs offer an alternative to traditional usernames and passwords, especially for organizations with Single Sign-On (SSO) enabled, allowing secure authentication of automated tooling and custom integrations. Users can manage up to 10 PATs, which inherit the roles and permissions of their owners, and configure expiration dates for up to 12 months. Additionally, Kong Konnect now integrates with various OIDC identity providers like Okta, Keycloak, and Azure Active Directory, enabling organizations to independently toggle authentication schemes and streamline user provisioning and access through Team Mappings. These advancements aim to improve integration with existing IT infrastructure and support service accounts, providing a more seamless and secure user experience.