August 2023 Summaries

The text discusses the critical importance of robust and consistent API access controls as the number of APIs continues to grow dramatically, presenting challenges for API security and infrastructure management. It emphasizes the need for organizations to adopt standardized API development processes and centralized management to prevent productivity loss, fragmented controls, and maintenance challenges. A comprehensive API management platform can address these issues by providing a unified control plane for security, traffic management, and analytics, ensuring organizational oversight and reducing the risks associated with "shadow IT." The text also highlights the role of the OpenAPI specification in securing APIs by defining usage requirements and mitigating unauthorized access, underscoring that API security is a shared responsibility between platform teams and organizational leadership. It concludes by stressing the urgency of implementing these changes to enhance API security, recommending Kong's API management solutions as a way to achieve consistent controls and improved productivity.

Kong Ingress Controller 2.11 introduces key enhancements, including the "last known good configuration" feature, which ensures new pods receive valid configurations even if there are issues with the Kubernetes API server. This feature caches the most recent valid configuration, allowing for smoother scaling and pod restarts without sacrificing durability. The update also improves monitoring capabilities with new Prometheus metrics and introduces support for Kong Gateway's readiness endpoint, enhancing traffic handling reliability. Additionally, KIC 2.11 supports new Kong Gateway features, such as the instance_name field for KongPlugin resources and the KongConsumerGroup custom resource definition, streamlining configuration management across multiple consumers. Furthermore, KIC 2.11 aligns with version 0.7.1 of the Kubernetes Gateway API, reflecting Kong's active role in its development and commitment to compliance with the latest standards.

The 3rd Annual Kong Hackathon, held in conjunction with API Summit 2023, invites the Kong community to explore API innovation through Artificial Intelligence. Open to individuals and teams of up to four, this month-long virtual event encourages participants to develop AI applications related to business, technical, and operational processes, either by enhancing existing projects or creating new ones. Submissions, which are open until September 27th, will be rewarded with digital badges and prizes, including gift cards for top contributions, and each entry will also result in a donation to the Diane Fossey Gorilla Fund. The Hackathon culminates with the announcement of winners during API Summit 2023 on September 28th, and participants can seek inspiration and support through Kong's Community Slack Channel. Notable past winners include innovative plugins for Kong Gateway and Insomnia, showcasing the event's focus on creativity and practical solutions.

GraphQL, a modern API technology developed by Facebook and governed by the GraphQL Foundation, offers a flexible alternative to traditional REST APIs by allowing clients to specify exactly the data they need, thus addressing issues of under-fetching and over-fetching associated with REST. Unlike REST, which centers around resources identified by URLs and standard HTTP verbs, GraphQL employs a type system to describe complex objects and their relationships, enabling clients to perform efficient queries and mutations with precise control over the data model. This specification supports real-time updates via Subscriptions, offering an opinionated solution that many GraphQL libraries implement using WebSockets. While REST boasts maturity and simplicity with a robust ecosystem and widespread developer familiarity, GraphQL introduces advantages in efficiency, versioning, and real-time data handling, appealing especially to mobile and data-intensive applications. Transitioning from REST to GraphQL can be facilitated by layering GraphQL capabilities on top of existing REST-based services, offering a pathway to leverage the benefits of GraphQL without a complete overhaul.

Kong Gateway has introduced WebAssembly (Wasm) support, allowing for the development and deployment of Wasm filters using languages like Rust and Go. This feature enables the extension of Kong Gateway with different languages, supporting more languages over time without additional operational overhead. WebAssembly is a specification for sandboxed language runtimes, providing a binary format for compiled bytecode and a multi-language virtual machine, with APIs for embedding the VM into host applications. Kong Gateway 3.4 supports WebAssembly extensions as Wasm filters, which are modules implementing event handlers for request lifecycle stages, using the Proxy-Wasm SDK. These filters can perform various proxy operations and be configured in flexible filter chains for Routes and Services. Developers are encouraged to experiment with Wasm filters, share their creations, and provide feedback to improve the feature. While the WebAssembly support is currently in beta, it aims to become generally available with community input, making Kong Gateway more versatile and expandable with the evolving Wasm ecosystem.

APIs are integral to modern software communication, yet unmanaged and unsecured APIs pose significant security risks, with attacks predicted to rise dramatically by 2030. Standardizing API governance is crucial for mitigating these risks while maintaining innovation and reducing costs. API standardization involves developing consistent guidelines to ensure reliability and security, facilitating easier scalability, and enhancing the developer and user experience. Effective API governance encompasses lifecycle management, including authentication, authorization, and monitoring, to ensure comprehensive security. Common vulnerabilities arise from rapid changes, complexity, and lack of visibility, which can lead to severe consequences like data breaches. Standardizing API governance offers security benefits by reducing vulnerabilities and enabling early detection and mitigation of threats while also streamlining development processes, reducing redundancy, and enhancing collaboration. This approach not only lowers costs and accelerates time-to-market but also improves user experiences by ensuring reliability and performance. Organizations like Grupo Globo and Rakuten have successfully implemented standardized API governance using platforms like Kong, which provide centralized management and consistent security. Overall, adopting a standardized, automated approach to API governance is essential for protecting against risks and fostering innovation.

Kong Gateway 3.4 introduces several significant enhancements for Kong Enterprise and Kong Konnect, highlighting its designation as a Long Term Support (LTS) release, ensuring technical support until 2026 for users of version 3.4.x.x. This release includes advanced features such as expanded plugin support in consumer groups, enhancing configuration management for businesses using tiered service offerings, and improved secrets rotation management, which complies with lifecycle requirements for sensitive information. Additionally, the update bolsters event-first architecture capabilities with enhanced Kafka plugins, enabling efficient data transformation and logging, and introduces support for Red Hat Enterprise Linux 9, catering to users upgrading to this distribution. While these features enhance security, scalability, and flexibility, the release also includes a beta version of the Wasm module, which is not covered by LTS support and is not recommended for production use.

Kong Gateway 3.4 for Open Source (OSS) introduces significant features, notably the support for WebAssembly (Wasm) as a beta feature, allowing users to write Wasm filters in Rust and Go without external dependencies. This update enhances the extensibility and customization of Kong Gateway by enabling developers to use their preferred programming languages, with plans to expand language support in the future. Additionally, the release includes support for TCP/UDP-based firewall rules in the IP Restriction plugin, complementing existing protocol restrictions and offering an efficient method to block or allow IPs or CIDR spaces at a lower protocol level. The Wasm module is disabled by default, ensuring no additional memory usage unless activated, and users are encouraged to provide feedback on the new features, with reference documentation available on the repository during the beta phase.

Organizations are increasingly turning to digital transformation to enhance efficiency, control costs, and improve customer experiences, especially in unpredictable economic climates. Transitioning from legacy systems to modern cloud-native, microservices-based architectures offers benefits such as agility and scalability but also introduces challenges like managing complexity and increased API volumes. API automation proves crucial in this context by automating the API lifecycle, which minimizes manual interventions, reduces errors, and accelerates development cycles, ensuring consistency and seamless integration. The approach streamlines workflows, enforces standards, and provides centralized control while enhancing observability and analytics. By adopting best practices in API automation, businesses can optimize efficiency, maintain compliance, and unlock innovation. They shift developers' focus from tedious tasks to adding business value, facilitated by technologies like API gateways and APIOps, which centralize API management and foster a federated model that balances flexibility with organizational standards. This holistic approach to modernization ensures applications are agile, scalable, and resilient, ultimately delivering long-term business value.

OWASP, a global non-profit organization founded in 2001, is dedicated to enhancing software security and is renowned for its "Top 10" lists, which identify the most critical web application security risks. In 2023, OWASP focused on API security risks, recognizing the increasing importance and vulnerability of APIs in modern applications. These risks include broken object level authorization, broken authentication, unrestricted resource consumption, and server-side request forgery, among others. To address these vulnerabilities, OWASP suggests various strategies, such as implementing robust authentication and authorization protocols, rate limiting, and secure data transmission. Kong, an API management platform, offers tools and plugins to mitigate these risks by providing comprehensive solutions for access control, request validation, and rate limiting, while emphasizing the necessity of ongoing security testing and adapting to emerging threats to maintain a strong security posture. As APIs become critical to innovation across industries, effectively managing their security is crucial for safeguarding against potential threats.

Modern organizations increasingly rely on APIs to enhance their digital customer experiences, with API gateways playing a pivotal role in managing these interfaces. API gateways act as intermediaries between customers and backend services, streamlining API management and offering features like authentication, rate limiting, caching, and request/response transformations. They are essential for companies operating with microservices or diverse digital offerings, as they provide scalability, security, reliability, and extensibility. When selecting an API gateway, businesses should assess their specific requirements, including security protocols, scalability, and integration capabilities. Popular API management platforms include Mulesoft Anypoint Platform, Apigee API Management, Amazon API Gateway, Azure API Management, Tyk, Gravitee, and Kong Gateway, with Kong noted for its performance and flexibility in various environments. A robust API gateway helps reduce operational complexities, allowing development teams to focus on innovation and delivering superior customer experiences.

In the context of modern API development, where REST, GraphQL, and gRPC dominate, the blog explores how Kong Konnect can effectively manage legacy SOAP/XML Web Services through the creation of custom plugins with the assistance of ChatGPT. As many organizations still rely on SOAP/XML for critical operations, the blog highlights the benefits of using ChatGPT to streamline the development of Lua custom plugins that handle XSD validation, XPath routing, and XSLT transformations for these services. By leveraging the extensive but complex GNOME C libraries, ChatGPT helps developers identify necessary functions, thereby expediting the coding process and enhancing plugin robustness. The deployment process for these plugins on the Kong Konnect platform involves configuration on both the Control Plane and Data Plane, facilitating efficient governance, security, and mediation of SOAP/XML services within a unified API management ecosystem.