July 2023 Summaries

Kong has partnered with Cloudsmith to enhance the hosting of its community and enterprise edition gateway packages, introducing a new repository layout that simplifies package management. Previously, packages were organized by gateway major version and OS version, but the new multi-format repositories allow for multiple formats and OSs within a single repository, named by gateway major-minor version. This change aims to streamline the setup process for users and offers a more engaging experience through the Cloudsmith platform, where users can explore package repositories, verify public keys, and utilize advanced search features. Older versions, such as Kong Gateway 2.7 and before, will reside in a "gateway-legacy" repository, maintaining the old metadata signing keys. The transition also brings improvements like UI-accessible, repo-specific metadata signing keys and enables Debian/apt repository metadata signing for all repositories. The previous download site will remain available for at least six months to ensure a smooth transition, with further details available in the documentation.

Kong experienced a crash on ARM64 platforms, such as those with Mac M1/M2 chips, triggered by an illegal instruction error in the LuaJIT ARM64 JIT compiler. This issue was identified through a detailed debugging process involving the use of LLDB on MacOS and the LuaJIT dump tool to isolate the problem within the code. The crash was linked to an error in the ADD, XLOAD code generation part of the LuaJIT ARM64 compiler backend, specifically within the instruction fuse optimization process. A solution was found by adjusting the offset handling in the LDP instruction to ensure it fits within the 7-bit offset field, thus preventing the generation of an illegal instruction. This fix, which impacts all ARM64 platforms and is OS independent, has been successfully tested with Kong running for over 10 hours without crashing and has been submitted to the LuaJIT upstream repository.

APIs have become foundational to digital transformation and internet traffic, driving innovation and connectivity across industries, yet they also present significant security challenges, as they are increasingly targeted by cyberattacks. Projections suggest a 996% surge in API attacks by 2030, with the cost per breach expected to rise to $14.5 million, highlighting the need for robust API security measures. The economic impact is particularly stark in the United States, where the cumulative cost of API-related attacks could reach $506 billion this decade. Despite their critical role, APIs are often under-prioritized in terms of security management, which can lead to vulnerabilities being exploited by attackers. To address this, organizations should treat APIs as mission-critical infrastructure, adopting consistent security controls, fostering a culture of accountability, and ensuring clear ownership and management of API infrastructures. This approach will help maintain operational agility while preventing potential disruptions and reputational damage from API-related incidents.

Kong has introduced new features in version 1.24.0 of decK, its declarative management tool for Kong Gateway, enhancing API lifecycle automation (APIOps) and facilitating federated API management. The update includes new commands for handling partial configurations, transformations, and declarative configuration generation, allowing for greater flexibility and collaboration in API management. Key additions include the ability to apply patches, merge configurations, manage tags, and add plugins, as well as a new command for generating Kong Gateway configurations from OpenAPI specifications. These enhancements support a federated approach to API management, empowering teams to coordinate effectively while maintaining central governance and shared infrastructure. The new features are designed to streamline workflows and improve efficiency in managing Kong configurations, with detailed documentation available for users to explore.

Global Rate Limiting in Kong Mesh introduces an efficient mechanism for managing request flow across microservices, enhancing security and performance by protecting against DoS attacks and managing API usage. This feature allows for the application of rate limits across multiple service instances, offering granular control through header-based strategies and the ability to extend limitations to external services. It simplifies traffic management by coordinating request counting and offers a seamless configuration process, particularly for Kubernetes deployments, with a requirement for a Redis deployment. By combining both local and global rate limits, Kong Mesh optimizes resource utilization and response times, ensuring robust traffic management and security in service mesh architectures.

Kong is inviting innovators and developers to share their experiences with APIs, microservices, and service mesh technologies through the #MyAPIStory campaign, which aims to spotlight the transformative impact these tools have had on organizations. Participants are encouraged to submit compelling summaries of their API projects, emphasizing the benefits and unique aspects of their work, alongside supporting materials. The campaign highlights Kong’s role in driving success and offers participants a chance to win gaming prizes, including a Donkey Kong Arcade game, a PS5, a new PC, and Kong-branded merchandise. Submissions will be evaluated based on criteria such as clarity, creativity, and the effective use of Kong's solutions, with the highest-scoring entry winning the grand prize. Entries are accepted from July 11 to September 30, 2023, and all stories have the potential to be featured on Kong's social media platforms, celebrating the contributors' achievements in digital transformation.

The Kong Konnect tutorial provides a comprehensive guide on managing an API ecosystem through its platform, demonstrating the process from setting up a Kong Gateway runtime instance in Docker to publishing APIs in a Developer Portal. It outlines steps to expose, secure, and manage an API Product using Konnect API Products, including configuring services and routes, applying plugins for rate limiting and caching to enhance performance, and securing services with key authentication to control access. The tutorial further explains how to create API products and versions, link services, and upload OpenAPI spec files for documentation, which can then be published to a Developer Portal for user access. Overall, it emphasizes the ease of deploying and configuring APIs in a centralized interface, allowing developers to concentrate on developing business functionalities, and invites users to start a free trial or explore additional resources for further learning and enhancement of their API management capabilities.