March 2023 Summaries

Kong is enhancing its presence in the AWS cloud by integrating its API management platforms, Kong Enterprise and Kong Konnect, with Amazon's VPC Lattice. This integration aims to simplify service-to-service connectivity, security, and monitoring within AWS environments. By leveraging VPC Lattice, organizations can manage cross-account and cross-VPC communication efficiently, addressing challenges related to service isolation and secure API management. The architecture allows the Kong Gateway to serve as a centralized entry point, abstracting backend microservices and enabling seamless interaction across different AWS runtimes such as EKS, ECS, and Lambda without additional networking complexities. The Kong API management platforms, known for their robust capabilities like OIDC integration and rate-limiting, enhance VPC Lattice architecture by providing a secure, cloud-native gateway with modern plugin architecture. Kong Konnect's availability in the AWS Marketplace simplifies procurement, accelerating time to market and offering cost savings.

Kong has released version 2.9 of its Kong Ingress Controller (KIC), focusing on enhancing solution extensibility, deployment flexibility, and reducing ownership costs. The new version achieves 99% conformance with the Kubernetes Gateway API 0.6.1, introduces support for gRPC routes, and improves visibility through Kubernetes Events by offering insights into configuration conflicts. It also allows independent scaling of the Ingress Controller and Kong Gateway data planes to optimize resource use and cost-efficiency. The Gateway Discovery feature automates the detection of data planes, facilitating dynamic scaling and reducing administrative overhead. These updates aim to provide users with a more flexible and efficient tool for managing their Kubernetes networking needs.

In early 2021, a new data team was formed to develop a real-time data platform for Kong's SaaS platform, Konnect, aiming to deliver advanced real-time API analytics. The initial architecture included an ingestion service, a message queue, and real-time OLAP data storage, with Apache Druid selected for backend data storage and AWS Kinesis for the message queue due to its managed service benefits and ease of setup. As the platform evolved, the team identified limitations in Kinesis, especially its lack of transactional writes across multiple topics, prompting a migration to Kafka, which offered better transaction support and a more active community. This transition involved integrating AWS MSK with Druid, requiring complex infrastructure setup across AWS accounts, which was facilitated using AWS Private Link for secure connectivity. The team implemented a zero-downtime data migration strategy by double-writing data to both Kinesis and Kafka, ensuring data parity during the transition. Additionally, a feature flag controlled the UI rollout to test the new Kafka integration internally before a full release. The migration to Kafka improved development productivity, resource utilization, and overall engineering efficiency, offering better community support and the ability to operate independently of external services for local development.

GraphQL authorization poses unique challenges compared to REST APIs due to its flexible query and mutation capabilities, leading to higher risks of authorization flaws. Organizations are often hesitant to adopt GraphQL because of these security nuances, which require distinct access control policies that are more complex than those for REST APIs. Currently, many development teams address these challenges by embedding access control policies within the codebase, although API gateways like Kong Konnect, integrated with Open Policy Agent (OPA), offer a promising solution. OPA facilitates the separation of policy from the service's code, enabling more transparent and standardized security practices. This integration allows for detailed authorization processes, including schema validation, query variable validation, and JWT token validation, creating a more secure GraphQL environment that parallels REST API security standards. The blog also presents a tutorial for implementing these security measures using Kong Konnect and OPA, demonstrating their application through a practical scenario involving the Frankfurter GraphQL API.

Kong Konnect is an API lifecycle management platform that utilizes a hybrid model for application modernization projects, allowing workloads to run on multiple platforms. The system consists of a cloud-hosted Control Plane for administrative tasks and a Data Plane, based on Kong Gateway, deployable across various environments such as VMs, Kubernetes, and Docker. This blog post guides users through installing the Data Plane Runtime Instance on Amazon Elastic Container Service (ECS), assuming familiarity with ECS components. It outlines the steps for preparing an ECS installation VM, configuring ECS profiles and clusters, creating necessary AWS Identity and Access Management roles and policies, and deploying the Konnect Data Plane. Once deployed, users can create and manage services and routes through the Konnect platform, apply API policies like rate limiting, and experiment with various plugins to enhance functionality. The post highlights the flexibility of Kong Konnect's architecture and its compatibility with AWS services, including ECS and EKS, while suggesting further enhancements through AWS and Kong documentation.

Kong has introduced its first Long Term Support (LTS) version of Kong Enterprise, specifically version 2.8 LTS, which will receive support until March 25, 2025. LTS versions provide prolonged technical support and security updates, appealing to users who require stability before transitioning to newer software versions. This initiative aims to assist clients, especially those in regulated sectors or with complex deployments, who may find frequent upgrades challenging. Kong's support strategy includes supported, sunset, and LTS versions, with the company releasing minor versions quarterly and patch updates on a staggered schedule. All minor versions of the 3.x series will have 12 months of support, while designated LTS versions will benefit from three years of assistance, including direct migration options between successive LTS versions. Notably, the LTS support will not extend beyond the end-of-life (EOL) dates for platforms like RHEL-7 and Debian 10, which are set to end before the LTS period concludes.

Kong has opened a new office in Singapore on March 1, 2023, marking a significant milestone in its expansion across the Asia-Pacific region due to record growth and increasing demand for its API platform in sectors like financial services, telecommunications, technology, and government. The new office is designed to support a flexible, hybrid work environment that encourages collaboration and creativity, reflecting Kong's commitment to fostering a productive workspace. The Singapore team, comprising diverse and skilled members, is poised to enhance the company's ability to serve local customers and partners, with Director of Partner and Alliances Adrian Phang emphasizing this as a landmark achievement for Kong. The expansion is seen as a testament to the hard work and dedication of the Kong team and their impact on the local community, with team members expressing excitement about contributing to the company's growth in the region.

Engineering organizations face diverse priorities when choosing an API management solution, with some focusing on optimizing resource utilization and others on enforcing strict privacy boundaries, depending on their specific needs. Kong provides solutions like Kong Enterprise and Kong Konnect to address these requirements, allowing flexible deployment of API gateway components. The architecture consists of control planes (CP) for configuration management and data planes (DP) for routing client traffic, with options like Hybrid Mode offering scalability and resilience. Organizations can choose between single-tenant and multi-tenant models depending on their priorities regarding data protection, operational burden, and resource optimization. Kong's configurations allow for nuanced management of API gateways, with options like workspaces offering isolation within a unified routing table. The choice between deployment strategies, such as the Kong Konnect Runtime Group model or the Kong Enterprise Federated model, involves trade-offs in operational complexity and data isolation, with Kong Konnect generally providing superior solutions due to its SaaS-based management capabilities.

Kong Konnect is a SaaS-based API lifecycle management platform designed to simplify the operation of Kong Gateway instances by offering a scalable, highly-available architecture and an Enterprise-class feature set. It provides key benefits such as simplified operations through SaaS-hosted control planes called Runtime Groups with a 99.99% SLA, governance capabilities for managing multiple gateway deployments, and additional services like a Service Hub, API Portal, and API Analytics. Migrating from Kong's open-source gateway to Konnect involves three straightforward steps: extracting the existing configuration, syncing it to a Konnect Runtime Group, and registering the gateway with Konnect. This migration process allows users to rapidly achieve a production-ready, distributed API gateway while benefitting from enhanced governance and operational capabilities. Konnect also offers a free tier to support the open-source community, providing a fast and efficient way to deploy, secure, and manage APIs across various environments.

GraphQL is an open-source API query language and runtime engine that offers a more flexible and efficient alternative to traditional REST APIs by allowing developers to specify exactly the data they want from an API, reducing the need for multiple API calls and minimizing network bandwidth usage. Created by Meta in 2012 to enhance the Facebook mobile app, GraphQL is now widely adopted by companies like GitHub, PayPal, and Netflix due to its ability to streamline data fetching and integration from various sources. Unlike REST, which requires coordination between services and clients, GraphQL enables developers to communicate directly with APIs using a single endpoint, making it particularly beneficial for mobile applications and scenarios requiring real-time data updates. It supports operations like queries, mutations, and subscriptions, providing real-time data capabilities and enabling efficient data management without over-fetching. Despite its advantages, GraphQL does present a steeper learning curve and requires more backend work compared to REST. Its strongly typed schemas and vibrant ecosystem of development tools, like Apollo and GraphiQL, further enhance its appeal by ensuring predictable query behaviors and ease of integration.

Kong Konnect has introduced several new features, including portal role-based access control (RBAC) API, support for Kong Gateway 3.2, and an OpenAPI Specification (OAS) Validation plugin, enhancing its capabilities for managing APIs and developer access. The Portal RBAC API allows for the creation and management of developer teams with specific access permissions, streamlining security and administration. Kong Konnect now supports Kong Gateway 3.2, which includes features like global sessions for the OpenID Connect plugin and latency-based steering, and it enables deployment across various environments. The OAS Validation plugin ensures API requests and responses adhere to a standard definition, offering webhook notifications for failed validations to aid in troubleshooting. These updates aim to improve the efficiency and security of API management within the platform.