June 2023 Summaries

Digital transformation in the financial services sector has led to the widespread adoption of APIs, which offer seamless user experiences and facilitate data sharing between financial institutions, fintech companies, and third-party service providers. While this innovation has created opportunities for open banking and new digital payment systems, it has also introduced significant security challenges, particularly concerning data breaches and unauthorized access. API management solutions are crucial for ensuring financial compliance and security by enabling institutions to oversee their API connections, standardize practices, and maintain data governance and privacy regulations. These solutions address risks like reduced observability and unauthorized access, helping financial institutions meet compliance standards such as GDPR, PCI DSS, and others. API management tools also foster scalability and consistency, reducing inefficiencies and enhancing consumer trust. As financial institutions continue to navigate technological advancements like AI and microservices, robust API management frameworks will be essential in maintaining compliance and enabling secure, innovative solutions that support organizational growth.

Kuma 2.3 introduces experimental support for GAMMA, a subproject of Gateway API tailored for mesh implementations, which enhances how in-mesh traffic is managed using the HTTPRoute resource. Gateway API aims to improve networking APIs in Kubernetes, providing resources like Gateway and HTTPRoute to model ingress traffic and routing. GAMMA extends these APIs to mesh use cases, allowing standardized routing and traffic modification across implementations. This release enables users to specify routing rules within a Kubernetes mesh by attaching HTTPRoute resources to Service parents, though this feature is still in its experimental phase. Kuma's integration with GAMMA facilitates traffic management by allowing users to define consumer and producer routes, thereby controlling traffic flow and modification at a granular level, and it has already passed several conformance tests. The project encourages community involvement and aims to explore broader use cases of Gateway API for service meshes.

Kong Enterprise and Kong Konnect Data Planes have been validated to run on AWS Graviton3 processors and Amazon Linux 2023, delivering significant performance improvements over previous Intel-based C6i instances. In benchmark tests, the Graviton3-powered C7g instances demonstrated a 42% increase in requests per second and a 39% reduction in latency times compared to C6i instances, showcasing enhanced throughput and efficiency for API management. The testing scenarios included configurations with no plugins, a rate-limiting plugin, and both rate-limiting and API key plugins, highlighting the scalability of Kong Enterprise. The integration of Graviton3 processors not only boosts performance but also offers substantial cost savings, positioning Graviton3 as a leading choice for optimizing cloud environments.

Kong Mesh 2.3 introduces significant enhancements in security, flexibility, and resiliency, reinforcing its role as an enterprise-grade service mesh. The release includes the integration of Envoy proxy version 1.26 to bolster security and implements least-privilege defaults in Kubernetes to enhance zero-trust frameworks. Flexibility is improved with delta configuration updates to reduce bandwidth in global control planes and more customizable installation options for GitOps workflows. The release also features experimental support for GAMMA resources, allowing for advanced traffic routing and management, and introduces performance improvements for high-volume Kubernetes environments. Additionally, Kong Mesh 2.3 enhances init container ordering for predictable sidecar behavior in complex microservices architectures, addressing the growing dependency challenges as applications scale.

Kong Mesh 2.2.0, now available in the Red Hat Ecosystem Catalog, offers a service mesh solution that enhances networking flexibility and centralizes control across various environments, including VMs and cloud-native workloads like Red Hat OpenShift. By integrating with Red Hat OpenShift, Kong Mesh supports hybrid cloud deployments, easing the complexity of managing diverse platforms and workloads. It allows for seamless communication between zones, enabling microservices to function without awareness of underlying infrastructure differences, and supports multiple business units through multi-tenancy. The use of Kong Mesh facilitates modernization and migration of workloads from on-prem to cloud environments, providing traffic management capabilities to gradually deprecate legacy systems. Additionally, it supports high availability for cloud regions, ensuring operational continuity even during regional outages. The post includes a tutorial on deploying Kong Mesh in Standalone Mode on Red Hat OpenShift Service on AWS, showcasing its potential to unify on-prem and cloud workloads effectively and aid in modernization strategies.

API monetization is a burgeoning trend for organizations aiming to increase revenue by leveraging their existing APIs through various billing models, such as post-paid, pre-paid, or pay-as-you-go. Successfully monetizing APIs involves constructing a comprehensive technology stack that includes components like API management, analytics, and billing providers to efficiently handle tasks such as usage tracking and invoicing. Choosing the right stack is essential for meeting current business needs while allowing future scalability and feature expansion. API gateways, like Kong, simplify API security and management, whereas analytics platforms such as Moesif enhance monetization by tracking API usage and integrating with billing providers like Stripe, Recurly, and Chargebee. The selection of a billing provider should consider integration complexity, cost, reporting capabilities, and customer support, as these factors significantly impact the revenue generated from APIs. Tools like Moesif and Kong facilitate a seamless API monetization process by offering comprehensive features for tracking, billing, and managing API usage.

Enterprises are increasingly investing in data mesh and API platform initiatives to enhance decision-making, foster innovation, and improve agility by productizing business domains as self-service digital assets. Both initiatives aim to shift from project-based to product-based thinking, placing business domains at the core of organizational design and promoting decentralized, domain-aligned architectures. Data mesh decentralizes data architecture by organizing data according to business domains, while API platforms productize business logic and processes. These initiatives advocate for cross-functional teams that manage long-lasting business domains autonomously, exposing business logic and data through APIs. The initiatives are linked by their shared objective of creating a self-service platform that aligns with business priorities, driving enterprise KPIs such as revenue, margin, and risk management. By aligning API and data mesh strategies, enterprises can synchronize their evolution, reduce duplicative efforts, and build a federated network of business domains supported by a central enablement team, ultimately enhancing their ability to deliver innovative and agile solutions.

Kong Ingress Controller (KIC) 2.10 introduces several enhancements aimed at improving usability and performance. The update includes an early access preview of the new Rust-based Expression Router, which offers increased efficiency and support for complex route configurations, marking a step towards full Gateway API conformance. Enhanced Kubernetes event handling provides better operational insight, with new features like the KongConfigurationSucceeded event allowing for more controlled deployments. The Gateway Discovery DNS feature improves security by enabling DNS names for gateway discovery, enhancing TLS certificate verification. Additionally, a new combined Helm chart simplifies deployment by integrating KIC and Kong Gateway into a single, streamlined process. The release is designed to be compatible with existing configurations while offering new functionalities to ensure a seamless user experience.

In the current era of software evolution, the emergence of new architectural patterns has profoundly influenced how enterprises build, deploy, and utilize services, leading to innovative project workflows. This shift has facilitated the adoption of automated processes by DevOps and engineering teams, streamlining key aspects of API lifecycles and reducing overall complexity. A pivotal component of this transformation is the use of API Gateways, which serve as a solution to these challenges.

Zero Trust Security is a modern cybersecurity framework that challenges traditional perimeter-based models by assuming no implicit trust in users, devices, or network connections, regardless of their location or past behavior. This approach emphasizes continuous verification and authorization for every access request, aimed at securing individual resources and minimizing the attack surface. Key principles include least privilege access, microsegmentation to prevent lateral movement within networks, and an "assume breach" mindset that focuses on detection and response. To effectively implement Zero Trust, organizations must focus on strong identity verification, device access control, and continuous trust evaluation, leveraging real-time analytics and adaptive access strategies. Benefits of adopting this model include enhanced security for remote and distributed workforces, improved breach detection and containment, and maintaining consistent security across cloud and hybrid environments. Zero Trust requires strategic alignment across the organization, integrating advanced tools and fostering a culture of security awareness to adapt to evolving threats.

API security is increasingly crucial as API exploits become more common, and implementing robust authentication and authorization measures is essential to safeguarding data. Authentication verifies a user's identity, while authorization determines what data a user can access, akin to checking a library card for access to rare books. Various authentication methods, including Basic, Token, OAuth, and API Key authentication, offer different levels of security and ease of implementation. Basic authentication, although easy to implement, is less secure due to its vulnerability to breaches, while Token and OAuth authentication provide enhanced security through encrypted tokens, although they require more effort to set up. API Key authentication, specific to applications rather than users, offers programmatic access but lacks the expiration feature of tokens. Choosing the appropriate method requires balancing security needs with user experience, considering factors like sensitivity of data and user technical expertise. Using both authentication and authorization together ensures that only the right users can access the appropriate data, providing an essential layer of security for APIs.

Viktor Gamov, a Principal Developer Advocate at Kong, explores the capabilities of Kong Konnect, a SaaS-managed control plane for Kong Gateway, which simplifies API management by offering features such as application registration, Dev Portal configuration, and service access management. Kong Konnect allows for different deployment modes, including DB-less, traditional, hybrid, and SaaS, with an emphasis on its SaaS offering that eliminates the need for database maintenance and control plane management. This service introduces Runtime Groups for segregating environments and regions, enhancing scalability and compliance with regulations like GDPR. A demonstration using the ChatGPT API showcases how to create services, configure routes, and utilize plugins such as Request Transformer and Rate Limiting to manage API traffic and access. The guide also highlights the process of publishing services on the Dev Portal, enabling application registration, and managing consumer groups to control access and usage limits. Additionally, Kong Konnect's ability to replicate services across different regions, such as the US and EU, with ease through configuration syncing, is emphasized as a key feature for distributed service architectures.