May 2023 Summaries

Kong Gateway's 3.3 release introduces a revamped queue implementation used by various plugins to efficiently handle data transfer to upstream servers, addressing limitations of the previous system. Queues are essential for decoupling data production from submission, preventing high concurrency and resource strain during heavy traffic or when upstream servers face issues. The new design improves memory management by introducing capacity limits, consumer-side batching, and streamlined retry logic with exponential back-off patterns. These queues are memory-based, residing within each worker process and are not shared, ensuring efficient data handling while mitigating performance issues from the previous design, such as extensive timer usage. The update also facilitates better configuration and observability, enabling users to fine-tune queue parameters like max_entries and max_batch_size to align with specific operational needs, while automatic conversions assist in transitioning from previous configurations. This new queue system is integrated with plugins like Datadog, HTTP Log, and OpenTelemetry, with plans to extend its use across more plugins in the future.

Kong Gateway 3.3 Open Source release introduces significant enhancements to its API gateway, emphasizing increased performance, reliability, and observability. This version features the introduction of an OpenAPI Spec for the Kong admin API, promoting transparency and encouraging creative third-party development. It also introduces configurable queuing behavior for tracing, metrics, and logging plugins, allowing operators to manage memory consumption effectively and improve gateway performance. Additionally, the release includes a readiness probe for Kubernetes users to ensure traffic is only received upon valid configuration, as well as improvements to the OpenTelemetry plugin for enhanced API call visibility and span accuracy. These updates underscore Kong's commitment to providing a top-tier API gateway experience, with further technical insights to be shared in an upcoming blog post.

Kong Gateway 3.3 for Open Source introduces enhanced features focused on reliability, security, and governance for enterprise-level needs. The updates include improvements such as configurable queuing behavior, high-scale reliability with readiness probes, and enhancements to the OpenTelemetry plugin, which are integrated into both its open-source and enterprise versions. Notably, Kong Enterprise now includes an OpenAPI Spec for its admin API to promote transparency and developer collaboration, and a Software Bill of Materials (SBOM) to enhance security and compliance. The SBOM offers detailed insights into the software's components and is available in industry-standard formats like cycloneDX and SPDX. Additionally, Kong Enterprise 3.3 supports AWS Identity and Access Management (IAM) database authentication, allowing secure connections to Amazon Aurora and RDS, thereby enhancing access management and data security. Furthermore, the Kong Konnect platform now enables users to associate metadata with data planes, which aids in organizing and managing data plane clusters. These enhancements reflect Kong's commitment to providing innovative, secure, and efficient solutions in the evolving digital landscape.

Kong Gateway can be deployed in four popular ways depending on the specific use case: DB-less mode, Traditional mode, Hybrid mode, and Kong Konnect. DB-less mode offers a quick and lightweight setup using a declarative configuration file, ideal for running the Kong Ingress Controller, although configuration changes require resubmission to the Kong API. Traditional mode requires a database to scale deployments and make incremental configuration changes via the Kong Admin API, but could lead to extensive database maintenance efforts. Hybrid mode addresses the challenge of excessive database calls by separating the data plane, which handles user traffic, from the control plane, which manages configurations and communicates with the database. Kong Konnect is suited for organizations with numerous APIs across diverse environments by providing a cloud-managed control plane with built-in analytics, a Service Hub for service management, and support for GitOps and APIOps configurations. Users can quickly begin with Kong Gateway in DB-less, traditional, or hybrid modes, or opt for a trial of Kong Konnect for a cloud-based solution.

API keys are unique codes used to authenticate and authorize access to the features, data, or resources of an API, ensuring secure communication between software applications by preventing unauthorized access to sensitive information. These keys provide an extra layer of security, enable access control, facilitate usage tracking and billing, and promote integration between services. There are various types of API keys, such as public, secret, JWT-based, session-based, and scoped keys, each tailored to specific use cases and security needs. Client-side API keys are intended for public data or read-only operations and are exposed to users, while server-side API keys are kept secret and used for accessing sensitive data or performing write operations. Generating an API key typically involves selecting the key type and securely storing it, highlighting the importance of proper management to minimize unauthorized access. Overall, API keys are crucial for maintaining efficient, secure, and controlled access to APIs, thereby supporting innovative software development.

Kong Insomnia's latest release, version 2023.2.0, introduces several updates aimed at enhancing API management capabilities. The release features an improved Import flow, addressing user feedback for more intuitive and controllable data importing from various sources like files, URLs, and clipboard, while ensuring accurate data representation. This improvement simplifies collaboration through the "run in Insomnia" button, maintaining support for popular formats such as Postman, Swagger, and OpenAPI. Additional enhancements include support for Kong 3.0, allowing users to generate declarative configuration files directly from OpenAPI specs, and the return of Swagger/OpenAPI preview with support for OpenAPI 3.1 specs, enabling easier API documentation testing. The update also includes various other improvements and bug fixes, with details available in the changelog. Users are encouraged to upgrade to the latest version to benefit from these enhancements and provide feedback for future updates.

Event streaming is a crucial component for building real-time applications that require scalability and support for high concurrency, and the event gateway pattern plays a vital role in managing access and control to this infrastructure. By utilizing the Kong Konnect Kafka Upstream plugin, companies can create an event gateway on top of Amazon Managed Streaming for Apache Kafka (MSK) with advanced API management capabilities. This setup uses Kong Gateway to provide a centralized layer for orchestrating microservices, offering features like authentication, rate limiting, and real-time monitoring, while its extensibility allows for integration with various backend services. The Kong Gateway supports hybrid deployments, adding flexibility to cloud migration projects, and when combined with Amazon MSK, it can enhance service connectivity for modern architectures. The blog post details the process of deploying a Kong data plane on an Amazon EKS cluster, configuring an Amazon MSK cluster, and using the Kong Gateway to manage event streaming while ensuring security and efficient API management.

Kong has been recognized as a 2023 Customers' Choice in the Gartner Peer Insights for Full Life Cycle API Management, highlighting customer trust in its cloud-native API platform for speed, scalability, and security. Several customers praised Kong for facilitating microservices interactions and enhancing API operations, with one noting its impact on their business strategy, while another emphasized the company's responsive support and effective roadmap delivery. This accolade adds to Kong's previous recognition as a Leader in the 2022 Gartner Magic Quadrant for Full Life Cycle API Management for the third year in a row. Gartner clarifies that its research consists of opinions and does not endorse any specific vendor, and the Peer Insights reviews reflect individual user experiences rather than Gartner's own views.

Creating API design guidelines plays a crucial role in establishing a cohesive API strategy within enterprises by fostering a standardized approach to API development. These guidelines serve as a foundational framework for developing high-level tools and services, enabling developers to focus on business logic rather than integration complexities. The guidelines encompass general best practices such as API-first design, backward compatibility, and security measures, alongside style-specific recommendations for various API types like REST, GraphQL, and gRPC. They also outline governance processes for updating the guidelines, ensuring continuous improvement through stakeholder feedback. By adhering to these guidelines, API consumers benefit from a consistent and intuitive experience, while producers can focus on core functionalities without worrying about common interaction patterns. Security operations are enhanced through standardized security protocols, and enterprise architecture is strengthened by ensuring all APIs conform to the established guidelines. To promote widespread adoption, the guidelines should be materialized through artifacts like SDKs, templates, golden images for security compliance, and APIOps pipelines, making adherence the most efficient path for developers.

APIs (Application Programming Interfaces) enable the interaction between software systems, fostering enhanced features and capabilities across platforms. There are several types of APIs, each designed for specific use cases: Open APIs facilitate data access without exposing source codes, Partner APIs streamline B2B interactions, Internal APIs support intra-organizational communication, and Composite APIs unify data from multiple sources. Moreover, different API protocols such as REST, SOAP, GraphQL, Webhook, and RPC address various needs, offering different strengths like REST's scalability and SOAP's security. API request methods—GET, POST, PUT, DELETE, PATCH, and others—define how client applications interact with systems, each suitable for specific tasks such as data retrieval or resource updates. Understanding these API types, protocols, and methods is vital for developers to create effective, modern web applications tailored to their specific requirements and goals.

Kong's community stands out for its diverse and supportive nature, fostering a global network of over 160,000 members including developers, customers, partners, and tech enthusiasts. The community offers various engagement opportunities, such as monthly newsletters, technical webinars, user calls, livestreams, and a Contributor Program for both code and content contributions, catering to a wide range of interests and expertise levels. Members can benefit from around-the-clock support due to the community's global reach and time zone diversity. The Kong Champions Program recognizes and encourages individuals who actively assist others within the community, while Kong Docs provides comprehensive product documentation. Additionally, the community hosts over 80 Meetup groups worldwide, promoting in-person interactions and discussions.