December 2022 Summaries

As 2022 concludes, Kong reflects on its significant milestones and achievements throughout the year, highlighting the substantial growth and engagement within its community and product advancements. Notably, Kong's API management platform processed over 11 trillion API calls monthly, marking a notable increase in activity. The company celebrated its fifth anniversary and expanded its global presence, introducing new features across its products such as Kong Konnect, Kong Gateway, Kong Mesh, and Kong Insomnia. The community's growth was evident, with over 190,000 members and numerous accolades for contributors, including Tharun Rajendran and Sven Bernhardt, who were recognized for their roles in bolstering community engagement. In-person events returned, with Kong Summit 2022 being a key highlight, bringing together a diverse range of participants to celebrate advancements in API and microservices. Additionally, Kong received accolades from Gartner, G2, Deloitte, Forbes, and CRN, underscoring its leadership in API management and its commitment to innovation and user satisfaction.

Kuma 2.0 introduces a new policy matching API designed to improve the configurability of service meshes by addressing limitations in the previous system, such as unclear policy application and difficulties in composing policies due to shadowing and ordering issues. This upgrade involves the use of a "targetRef," a concept inspired by Kubernetes Gateway APIs, which categorizes dataplane proxies into logical groups like Mesh, MeshSubset, MeshService, and MeshServiceSubset, allowing for more precise and understandable configuration management. The new API simplifies understanding which proxies are configured, the traffic affected, and the specific configurations applied, by using top-level, from, and to targetRefs in policies. The system prioritizes these configurations using a hierarchical and lexicographic order, ensuring that more specific configurations take precedence. The introduction of these policies starts with features like MeshTrafficPermission, MeshAccessLog, and MeshTrace, with further developments planned for future releases. The changes aim to enhance ease of use and integration with the Kubernetes GAMMA initiative, although transitioning between new and old policies is currently not defined, with migration tools expected in future updates.

Kong Insomnia 2022.7 introduces several enhancements aimed at improving API quality and productivity, including a new organization sidebar that simplifies navigation and collaboration, available to all users. The update also adds support for gRPC server reflection, allowing users to access API definitions directly from a gRPC API without needing proto files, and embraces OpenAPI 3.1, offering features like webhooks support, JSON compatibility, and improved standards-based processes. Additionally, custom linting rules have been integrated, enabling users to ensure API quality and consistency through flexible validation options. These updates collectively enhance the developer experience, making Kong Insomnia a more robust tool for managing APIs.

IBM's decision to deprecate its Cloud API Gateway has prompted users to explore alternative solutions, with Kong emerging as a recommended option for migrating API Gateway endpoints. Kong offers both an open-source version and Kong Enterprise, which is enhanced with additional features such as enterprise plugins, a developer portal, analytics, advanced security, and 24/7 support, making it suitable for mission-critical applications. Kong Enterprise is utilized by notable companies like PayPal and Nasdaq and is known for its performance, processing thousands of transactions per second with minimal latency. Built on NGINX, Kong Gateway provides a lightweight, fast, and reliable core engine and supports a wide range of deployment environments and protocols. Its extensive ecosystem of plugins allows for high customization and API management functionality, and the platform's robust API governance capabilities help maintain a centralized API catalog for organizations. Kong's migration methodology focuses on defining key KPIs, analyzing components to be migrated, and prioritizing based on business benefits to streamline the process. The company's API management platform, including Kong Enterprise and Kong Konnect, offers a comprehensive solution for organizations transitioning from IBM's API Gateway.

Security Assertion Markup Language (SAML) 2.0 is an XML-based open standard primarily used for web-based single sign-on (SSO) authentication across multiple websites and applications, enabling users to securely access various services with a single set of credentials. In the context of Kong Enterprise, the SAML implementation supports the service provider-initiated SSO flow, where a user trying to access a resource is redirected to an identity provider (IdP) for authentication if no active session exists. Once authenticated, the user is redirected back to the service provider with a SAML assertion, which is verified before granting access. The Kong SAML plugin, available in version 3.1 and above, facilitates this process with configuration options such as obtaining an IdP certificate, setting up an ACS endpoint, and using the IdP sign-in URL. Despite being considered legacy compared to newer protocols like OAuth 2.0 and OpenID Connect, SAML remains a widely adopted enterprise solution, prompting Kong to develop and expand its SAML plugin to support other identity providers in the future.

Kong Konnect has introduced new features aimed at enhancing security and simplifying API management, including predefined teams for Kong Analytics, dynamic client registration, and expanded application registration support. The new predefined teams, Analytics Admin and Analytics Viewer, allow organization admins to delegate specific analytics access and management responsibilities, enhancing security and flexibility. Additionally, dynamic client registration for application management is now generally available, enabling integration with the Okta identity platform to streamline client authentication and authorization, thereby reducing setup overhead. Furthermore, the Kong Konnect developer portal now supports application registration across all runtime groups, not just the default one, providing greater flexibility for deploying applications. These innovations are hosted in the cloud, making it easier than ever to get started with Kong Gateway, with options for a free trial or a personalized demo available.

Kong Enterprise 3.1 has been released, featuring the introduction of five new plugins and enhancements to existing ones, which enhance the functionality and performance of APIs. The new plugins include AppDynamics, SAML 2.0, OpenAPI Specification (OAS) Validation, JWE Decryption, and XML Threat Protection, each offering specific benefits such as improved observability, enhanced security, and validation of API requests and responses. These plugins are designed to integrate seamlessly with existing systems and deliver critical functionalities like traffic control, authentication, and logging, thereby making Kong Gateway highly customizable and easy to use. Additionally, enhancements to the Mocking plugin allow for improved API testing, and the Kong Manager now supports new features like Consumer Groups, Secrets Management, and Dynamic Plugin Ordering, along with various UX improvements. These developments underscore Kong's commitment to providing a highly efficient and adaptable API management solution for its enterprise customers.