October 2022 Summaries

When migrating Kong Manager's continuous integration from Jenkins to GitHub Actions, a test failure revealed a deeper issue related to the Kong instance's inability to communicate with the testing framework, resulting in an unusual exit code due to an illegal instruction. The investigation traced the problem to the inclusion of an ADX instruction set in the libgmp library, which was incompatible with the GitHub Actions runner's older CPU model, a Haswell-based Intel Xeon E5-2673 v3. This occurred because recent changes to the Amazon AWS instance type for the build pipeline allowed the libgmp build script to optimize based on the newer CPU model, inadvertently introducing unsupported instructions. To resolve this, the build script was adjusted to prevent optimization based on the build machine's CPU, ensuring compatibility across different processors. This proactive approach not only resolved the issue but also emphasized the importance of investigating test failures to prevent potential production issues, reinforcing the commitment to software quality and stability for customers.

In the rapidly evolving cloud ecosystem, eBPF (extended Berkeley Packet Filter) is emerging as a transformative technology in the Linux Kernel to improve application performance by enabling high-performance observability, security, and networking directly within the operating system. Unlike traditional cumbersome kernel modules, eBPF allows dynamic loading of programs into the kernel with safety and efficiency, leveraging a Just-In-Time (JIT) compiler and verification process. This document illustrates the creation of a simple UDP load balancer using eBPF's eXpress Data Path (XDP) in Rust, utilizing the aya framework. The tutorial assumes a strong foundational knowledge of Linux, networking, and Rust programming, and provides a step-by-step guide to setting up the Rust build environment, scaffolding a project, and processing UDP packets for load balancing across multiple backend servers. While this demonstration provides a foundational understanding of XDP programs, it is intended for educational purposes and not recommended for production use, given the evolving nature of the aya ecosystem.

Kong Gateway's recent 3.0 release has officially endorsed Secrets Management, allowing users to securely manage sensitive information like database passwords and API keys without exposing them to contributors. Previously reliant on Role Based Access Control (RBAC) for limiting access, the new feature enables configuration management without revealing secret values. The supported vaults for Secrets Management include environment variables for open-source users and HashiCorp Vault, AWS Secrets Manager, and Google Cloud Secrets Engine for enterprise users. Kong abstracts these systems using nested keys, permitting secure storage and retrieval of secrets. The documentation tags fields supporting secrets as "referenceable," ensuring users know where vault references can be applied. An example usage involves storing a Redis password in HashiCorp Vault using the Proxy Caching Advanced plugin. The release also includes support for Google Cloud Secrets Engine, catering to GCP users, marking a significant step forward in enhancing data security in Kong Gateway deployments.

Kong Insomnia has introduced support for WebSocket APIs in its platform, available from version 2022.6.0 onwards, which was a significant update announced at Kong Summit 2022. This new feature addresses a highly requested capability from the community, allowing users to stream data over continuous connections. The WebSocket API support maintains the user-friendly experience of Kong Insomnia, featuring intuitive options such as Authentication, Headers, and Environments, similar to its REST client functionalities. Users can create and manage WebSocket requests with ease, utilizing timeline storage for connection details and a history menu to track past configurations. The interface also includes an events pane for message composition and review. Additionally, Kong Insomnia offers collaborative tools like Team Sync and Git Sync to share WebSocket requests among team members, and for larger scale operations, Kong Insomnia Enterprise provides expert support and solutions for scaling API projects.

Kong Konnect Cloud has introduced Multi-Region support, allowing customers to manage their entities across different regions using a unified interface, which aligns with the demand for distributed service architectures. This new feature is complemented by Custom Teams and Per-Entity Permissions, enabling organizations to assign roles specific to regions. The challenge of replicating data across regions led to the separation of authentication and authorization services, allowing for independent data replication behaviors while maintaining performance. The solution involved adopting eventual consistency through active-active database replication, which results in approximately a 750ms latency for data replication across regions. This latency is managed by automated clients using retries to handle temporary inconsistencies. The introduction of Multi-Region support marks a significant development in Kong Konnect Cloud's capabilities and is expected to drive further improvements in API distribution.

Kong, a global company with employees in over 28 countries, navigates the challenges of time zone differences and virtual environments by fostering strong connections among its team members through various initiatives. These include timezone-friendly events, playful Slack channels, and the celebration of milestones, all aimed at maintaining employee wellness and engagement. The company's culture emphasizes wellness through activities like virtual Zumba classes, wellness challenges, and a dedicated Slack channel for sharing healthy living tips. Communication and camaraderie are further enhanced through themed Slack channels, the Donut Slack plug-in for team building, and in-person gatherings where possible. Celebrating achievements and milestones is a key aspect of Kong's culture, with events such as Kong Day, Unplugged Weekends, and recognition of significant company accomplishments like appearing on the Forbes Cloud 100 List. Kong's core values of being "Global" and "Real" are reflected in their commitment to creating an inclusive and supportive work environment where employees are encouraged to bring their whole selves to work.

Kong Gateway, a lightweight and flexible API gateway, now supports dynamic plugin ordering as introduced in Kong Enterprise 3.0, allowing users to customize the execution order of plugins for API request processing. This feature enhances the static priority system previously used, which primarily relied on numeric priority integers to determine plugin order. With dynamic plugin ordering, administrators can explicitly define execution sequences, addressing cases where the default order does not meet specific needs, such as preferring rate limiting before authentication to protect backend services. Kong Gateway's plugin system enables specialized configurations, and users can access bundled plugins or create custom ones using the provided software development kit. The blog post by Viktor Gamov and Rick Spurgeon outlines the process of setting up Kong Gateway, testing features, and modifying plugin execution orders, demonstrating the flexibility and control offered by the dynamic plugin ordering system.