February 2023 Summaries

Kong Enterprise 3.2 has been released, introducing enhancements aimed at improving the reliability and functionality of its API management solution in hybrid environments. Key features include the introduction of a "backup node" to mitigate issues between control and data planes, allowing data planes to retrieve configuration data from cloud storage in case of control plane failure. The release also includes latency-based steering using an exponentially weighted moving average for improved load balancing, and enhancements to Kong Manager, such as the ability to create key entities and export license reports directly from the UI. Additionally, it supports global sessions for OIDC and has achieved FIPS 140-2 compliance for all core components and first-party plugins. Updates have been made to plugin documentation for better clarity, and new features are designed to facilitate ease of use and improved performance in high-traffic scenarios.

Red Hat OpenShift is a leading enterprise Kubernetes platform that operates across on-premises and cloud environments, with the Red Hat OpenShift Service on AWS (ROSA) simplifying its deployment in the cloud. Kong offers a multi-platform, multi-cloud API management solution, emphasizing secure API management in hybrid cloud ecosystems, which are challenges many organizations face today. Kong has developed a comprehensive tutorial to guide users through implementing an APISecOps strategy, focusing on principles like Centralization, Governance, API Design-First, and GitOps. This tutorial employs various tools, including Kong Konnect for API management, Kong Insomnia for design, and Red Hat OpenShift Pipelines for CI/CD integration, starting from infrastructure configuration using Ansible playbooks to deploying APIs through Tekton Pipelines. The process involves updating API specs, governance reviews, converting specs to manifest, and promoting them across environments, with supplementary resources available on GitHub and YouTube for further guidance.

Developers often face troubleshooting challenges, illustrated by a scenario where a colleague's oversight in compiling code caused unexpected behavior. The text offers a guide for resolving issues with Kong Gateway, the popular API gateway, emphasizing practical troubleshooting strategies. Techniques include examining request headers, using the Kong-Debug header for insights, identifying global plugins affecting behavior, and visualizing the entire environment to uncover potential misconfigurations. The guide also recommends ensuring compatibility with Kong's latest features and updates, utilizing granular tracing for performance issues, and leveraging resources like Kong's Knowledge Center and community support. By focusing on systematic problem-solving, the guide aims to assist developers in navigating Kong's complexities and resolving common issues efficiently.

API SecOps is a strategic approach focused on securing APIs through a collaborative effort among developers, governance, and operations teams, emphasizing an API Design-First methodology. This framework aims to streamline the management of APIs in a secure and efficient manner, particularly as organizations increasingly adopt multi-platform and hybrid cloud solutions. Central to API SecOps are its four core principles: centralization of API operations, governance through policy-as-code, API Design-First to align with all stakeholders, and GitOps for handling API specifications. The integration of API, microservice, and policy lifecycles is crucial for delivering secure services to production, with testing phases such as "Mocking" playing a pivotal role in ensuring APIs meet business, security, and operational standards before deployment. By incorporating API Design-First and fostering collaboration, API SecOps breaks down communication barriers and enhances productivity, addressing the growing concern over API security as predicted by Gartner, which foresees API data breaches as a primary attack vector.

Organizations face significant challenges in meeting audit and compliance requirements, particularly in securing sensitive data and monitoring unauthorized activities. AWS CloudTrail Lake now supports recording user activity from various sources into a single, immutable storage for audit logs, enhancing the capability to respond to security incidents and audit requests. The recent integration of Kong Enterprise with AWS CloudTrail Lake allows Kong's audit logs to be stored and queried alongside AWS and non-AWS events, facilitating comprehensive compliance support. This integration involves creating a channel for Kong to deliver events to the AWS event store, deploying infrastructure components such as a Lambda function and ElastiCache-Redis, and configuring the Kong Admin API to handle audit logs. The infrastructure is validated through AWS CloudWatch, and Kong's audit logs are mapped to CloudTrail event data, ensuring no information is lost. This integration aims to simplify compliance efforts by centralizing Kong Gateway Audit logs within AWS infrastructure, enhancing security and monitoring capabilities.

Nathaniel Reynolds, Associate Director of Informatics Architecture & DevOps at Moderna Therapeutics, discusses the importance of service mesh, open-source platforms, and AI in enhancing developer efficiency and infrastructure reliability. As the number of applications increases, connectivity requirements grow, and service mesh provides scalable API connectivity, freeing application teams from infrastructure management. Reynolds emphasizes the advantages of open-source platforms like Kong Mesh and Kong Gateway, which offer a broader range of tools and portability across environments, essential for addressing complex organizational needs. He advocates for incorporating fail-safes and AI to streamline processes, reduce mundane tasks, and improve security. Moderna prioritizes building a scalable, security-first platform, combining API gateways with service mesh to simplify developer responsibilities and enhance productivity. Reynolds highlights the significance of maintaining robust infrastructure with dedicated personnel, underscoring the benefits of a platform that optimizes developer experiences and supports the efficient management of digital processes.

In the blog post, Shane Utt and Viktor Gamov explore the process of building gRPC APIs using the Rust programming language, leveraging the Tonic framework for efficient and high-performance communication between backend services. The authors explain how gRPC, a Cloud Native Compute Foundation (CNCF) project, enhances the setup and maintenance of RPC APIs by utilizing HTTP/2 and Protocol Buffers for automatic code generation. The article provides a step-by-step guide to creating a gRPC service in Rust, focusing on developing a grocery store inventory system that supports adding, removing, updating, and streaming item data. It also discusses setting up an API client using Rust's Clap for command-line interaction and testing the server with the Insomnia tool. While Rust is not a core language for gRPC, the post demonstrates its suitability for high-performance applications due to its memory safety and execution speed, encouraging developers to experiment further by adding features like TLS and authentication.

Kong Mesh and Kuma 2.1 have been released with a suite of new and improved policies that enhance service mesh capabilities, including MeshHTTPRoute, MeshCircuitBreaker, and MeshRateLimit, among others. This update finalizes the implementation of next-generation policies introduced in version 2.0, emphasizing a more flexible and powerful policy matching system inspired by GatewayAPI, which allows for complex and granular control over traffic routing and configuration. The update also introduces user experience enhancements such as a streamlined UI with simplified navigation, metadata-based filtering options, and improved debugging tools for managing Envoy data plane configurations. Users are encouraged to upgrade easily via kumactl or Helm to leverage these advancements, while further UI improvements are anticipated in upcoming releases.

Kong Konnect has introduced several new features aimed at enhancing user experience and functionality, including consumer groups, dynamic client registration, plugin ordering, and a streamlined Docker runtime instance creation process. The addition of consumer groups allows users to manage custom rate limiting configurations for different subsets of consumers, simplifying the process by centralizing related consumers and applying policies based on business needs. Dynamic client registration now supports integration with identity providers like Curity and Auth0, offering a more secure solution for distributed applications by reducing the overhead of credential management. The plugin ordering feature grants users flexibility in configuring the sequence of plugin executions according to their preferences, which can improve performance and security. The process for launching Docker runtime instances has been simplified, allowing users to initiate container-based runtimes with a single command, eliminating previous security concerns and optimizing the setup process. Users are encouraged to explore these features through the documentation or a free trial.