October 2023 Summaries

APIs are integral to the digital economy, playing a significant role in driving innovation and economic growth, with projections showing a contribution of $14.2 trillion to the global economy by 2027. Despite their importance, there is a knowledge gap between developers and senior leadership regarding the value of APIs, which can impact an organization's ability to fully leverage an API-first approach. The economic potential of API monetization is substantial, with expected revenue growth from $3.97 billion in 2023 to $8.56 billion by 2027. APIs are crucial for emerging technologies like generative AI, Web3, blockchain, and cryptocurrencies, enabling data exchange and integration, thus fueling further economic contributions and innovation. As APIs evolve into a smart neural network for the cloud, businesses are encouraged to adopt secure, API-first strategies to maximize innovation benefits while mitigating security risks.

API management and service meshes are integral in establishing secure and efficient communication within modern microservices architectures. Companies have been increasingly adopting full lifecycle API management platforms such as Kong to expose APIs safely while also exploring service mesh platforms to enhance internal service-to-service communications, known as East-West traffic. The combination of an API gateway, like Kong Gateway, and a service mesh, like Kong Mesh, facilitates the implementation of a zero-trust security model by providing authentication, authorization, traffic control, and observability across different zones and platforms. These technologies enable the segregation of applications into different meshes for improved isolation and cost reduction, support workload migration, and enhance developer productivity by offloading infrastructure concerns. The integration of API gateways and service meshes helps maintain security and performance, with tools like Kong Konnect offering a global control plane to unify the monitoring and management of both North-South and East-West traffic metrics, thereby allowing businesses to focus more on their core operations rather than technical control planes.

Shot-scraper is a tool adopted by the Kong documentation team to automate the process of capturing accurate and up-to-date screenshots for their documentation, especially when dealing with unreleased features in internal environments. By utilizing shot-scraper, which allows the execution of macros—predefined JavaScript functions—users can interact with web pages, hide specific elements, and prepare conditions before taking screenshots, avoiding the manual and repetitive task of using browser developer tools. This automation addresses common challenges with documentation screenshots, such as inaccuracies, inconsistencies, and resource consumption due to the fast-paced evolution of user interfaces. The Kong team integrates shot-scraper into their workflow, creating scripts that ensure reproducibility and consistency, enhancing their "docs-as-code" strategy. Furthermore, they emphasize the importance of building processes around shot-scraper and advocating for its use among team members, highlighting its benefits for both documentation and design teams by improving efficiency and reducing the burden on resources.

Modern software design increasingly depends on distributed systems architecture, making robust and secure APIs essential, and GraphQL is no exception. This text discusses the use of Kong Gateway to protect and manage GraphQL endpoints, highlighting its capabilities as an API gateway that provides traffic controls, security measures, monitoring, and performance enhancements like caching and rate limiting. The Kong GraphQL Proxy Caching Advanced plugin optimizes performance by caching responses based on unique GraphQL queries, while the GraphQL Rate Limiting Advanced plugin protects resources by calculating request costs based on query complexity. Using APIOps methodologies with Kong's decK tooling and GitHub actions, KongAir deploys these plugins to automate API management and ensure reliable system performance. Kong Konnect enhances this process by offering a comprehensive API management platform with visual displays and analytics for better observability and configuration oversight.

Artificial intelligence (AI) is transforming business landscapes by providing new opportunities for creativity and problem-solving, as noted by Martin Casado of Andreessen Horowitz at the API Summit 2023. AI's potential for business use is expanding due to advancements in technology and economics, making it more accessible beyond large enterprises. Casado emphasizes the importance of businesses adopting AI and integrating it with APIs, which act as critical connectors between AI systems and other technologies. While AI's capabilities have sparked concerns about safety and copyright, Casado argues that these fears are overstated and encourages a focus on AI's potential for positive disruption akin to the microchip and the internet. He stresses the necessity for businesses to develop an API strategy to prepare for an AI-driven future where AI systems interact predominantly through APIs. Despite challenges, the ongoing AI revolution promises unprecedented innovations and benefits, urging enterprises to embrace these changes to stay competitive.

Kong Insomnia 8.3 introduces enhanced flexibility in project storage by reinstating 100% local storage through its Local Vault feature, alongside existing cloud synchronization and Git Sync options, catering to diverse user needs in API development and debugging. This update allows users to choose between local, cloud, or Git storage without mandating cloud usage, addressing user feedback that highlighted the necessity for a local-only option. Migration from pre-8.x versions defaults to Local Vault while maintaining optional Cloud Sync for collaboration, ensuring data privacy and control. Account management remains cloud-based for organization and billing purposes, though projects under Local Vault and Git Sync are excluded from cloud storage. The release underscores Kong's commitment to responding to user feedback, enhancing product capabilities, and expanding community support, with plans to double its engineering and support teams in the coming year. Insomnia's roadmap includes further development in local storage, project manageability, and security compliance, such as SOC 2, to provide a secure, scalable, and user-friendly environment for API lifecycle management.

The 3rd Annual Kong Hackathon, held alongside the API Summit 2023, focused on API innovation with artificial intelligence, showcasing impressive projects from the Kong Community. The first-place winner, Alparslan Avci, developed a plugin that uses OpenAI's ChatGPT to enhance API responses by translating them into more natural language. The second-place entry by br-chimarrao introduced a plugin for real-time translation of API responses into over 7,000 languages using AI models, offering increased accessibility with text-to-speech capabilities. Third place went to QuadAI, which aimed to improve the search functionality of Kong's Developer Portal by integrating AI for better API specification indexing and querying. Verifone GSC secured fourth place with a plugin that uses machine learning to provide natural language analytics of unstructured data, such as logs. AI Plugin Guru rounded out the top five with an add-on for Kong's Developer Portal that accelerates plugin development through ChatGPT-generated code. Many other noteworthy contributions were recognized with digital badges and contributions to the Diane Fossey Gorilla Fund, reflecting the community's enthusiasm and talent for AI and API development.

As businesses grow and their API attack surfaces become more exposed, the risk of data breaches increases, making API authentication a crucial security measure. API authentication verifies the identity of users attempting to connect to an application, using software protocols to ensure only valid users can access the application's features and services. This process involves sending encrypted login credentials to a remote server for verification, blocking access if the credentials are faulty. While HTTP Basic Authentication is the simplest method, sending a username and password with each API call, it is not recommended as a standalone solution due to its vulnerability to interception and lack of encryption. Despite its ease of implementation, Basic Authentication's drawbacks include fragility, lack of logout functionality, and difficulties in password resetting, highlighting the need for more robust authentication mechanisms to secure cloud communications and data in transit.

Kong has prioritized the security and reliability of its products in response to the recently discovered HTTP/2 'Rapid Reset' DDoS attack (CVE-2023-44487), which exploits the concurrent streaming capability of HTTP/2. This attack allows a client to overwhelm a server with numerous HTTP/2 stream requests that are immediately reset, leading to excessive resource consumption and a Denial of Service. Kong has released patches for all supported versions of its products, including Kong Gateway, Kong Mesh, and Kuma, to address the vulnerability. Users are advised to update to these patched versions, with Kong Enterprise updates available immediately and an updated Docker image for Kong OSS submitted for merging. For those unable to update immediately, Kong recommends disabling HTTP/2 support and reducing the HTTP/2 keepalive limit as mitigation steps. Kong remains committed to maintaining the security of its community and advises all users to assess their systems and implement the recommended patches and mitigation strategies.

The blog post highlights the integration of the SAML Plugin with Kong Gateway and Microsoft Azure Active Directory, focusing on how this enhances Kong’s API management capabilities. It explains the distinction between SAML and OpenID authentication protocols, noting that SAML is commonly used for enterprise Single Sign-On (SSO) scenarios while OpenID caters to consumer applications. The post details the SAML authentication process, where Kong acts as the Service Provider and Azure AD serves as the Identity Provider, illustrating the steps for configuration and the flow of user authentication. It also provides a practical guide for setting up the SAML Plugin in Kong Konnect, including the necessary configurations within Azure AD and Kong. The article is part of the Kong Champions series, which encourages users to explore Kong’s innovations and become part of the community by signing up as Kong Champions.

As organizations increasingly adopt remote work environments, they face significant challenges in ensuring secure access to their networks, particularly concerning API security. Traditionally, Virtual Private Networks (VPNs) have been used to provide encrypted connections to corporate servers, granting users full network access, which can pose security risks if credentials are compromised. Alternatively, Zero Trust Network Access (ZTNA) offers a modern, cloud-native approach by granting restricted, context-based access to resources, minimizing potential attacks through micro-segmentation and continuous verification. ZTNA is seen as more secure and scalable than VPNs, especially for organizations with growing remote workforces, as it provides resource-specific permissions and reduces the risk of lateral movement across networks. Transitioning from VPNs to ZTNA can be gradual, allowing companies to maintain existing VPN setups while adopting zero-trust policies incrementally. Ultimately, the choice between VPNs and ZTNA depends on organizational needs, size, and technical capabilities, with ZTNA offering enhanced security for larger and more complex environments.

OpenID and OAuth are two distinct protocols used for digital identity and access management, with OpenID primarily focused on user authentication and OAuth on delegated authorization. OpenID allows users to log into multiple websites using a single identity provider, simplifying the sign-in process but potentially introducing privacy and security risks if the provider is compromised. In contrast, OAuth enables users to grant third-party applications limited access to their data without exposing credentials, offering safer delegated authorization but requiring careful management of permissions and user education. OAuth 2.0, the latest version, enhances security and simplifies developer workflows, establishing itself as a flexible industry standard for API access. OpenID Connect (OIDC) merges elements from both protocols, offering seamless single sign-on and authorized access to user data by building on OAuth 2.0 with an identity layer. While OpenID has lost traction to social logins, OAuth is widely adopted for API integration and third-party app access, with developers needing to consider the specific use cases and trade-offs of each protocol to ensure a balance of simplicity, security, and functionality.

Intermittent failures in Kong Gateway CI running on the ARM64 platform were traced to a LuaJIT ARM64 JIT compiler error, manifesting as an incorrect arithmetic operation due to a variable being misinterpreted as a function value. The issue, occurring roughly once every 100 runs, was identified through a methodical debugging process involving the use of the Mozilla rr reverse debugger, which allowed for detailed examination of the program's execution. The problem was rooted in the LuaJIT's code generation phase, where incorrect memory address calculations led to errors in ARM64 assembly code due to a peephole optimization misinterpreting offset values. A fix was proposed and merged into the LuaJIT upstream, addressing the erroneous merging of load/store instructions by implementing additional checks for offset ranges. The sporadic nature of the error was attributed to the non-deterministic behaviors inherent in Lua and LuaJIT, such as undefined table iteration order and varying JIT compilation behaviors, which contributed to the intermittent nature of the failure despite consistent test inputs.

In the context of modern microservices architecture, Kong Gateway is utilized to manage APIs, but the need for custom filters beyond the standard library often arises, leading to challenges with traditional non-Lua PDKs due to their complexity and limitations. WebAssembly, particularly through the Proxy-Wasm specification, offers a solution by enabling the development of custom filters using familiar programming languages like Go, with the potential for seamless integration across platforms such as Kong Gateway, Envoy, and possibly Kuma. Introduced in 2015 and released in 2017, WebAssembly was initially designed for high-performance tasks in web browsers, but its use has expanded, allowing developers to write functions in high-level languages and compile them into wasm modules for execution in various runtimes. Proxy-Wasm enables these filters to run on any supporting proxy, providing flexibility and portability in creating and implementing custom solutions across different environments.

API Summit 2023 showcased notable announcements, including the launch of Kong Mesh in Konnect and Dedicated Cloud Gateways, as well as the release of Kong Ingress Controller (KIC) 2.12, which is a long-term support (LTS) version offering three years of support. This release integrates features such as Gateway Discovery, Kubernetes events debugging, and scalable pod configurations, previously exclusive to non-LTS versions. A standout feature of KIC 2.12 is the addition of rewrite annotations, facilitating the transformation of ingress paths without altering upstream services, enhancing ease of use. Moreover, KIC 2.12 introduces latency-aware routing using a peak EWMA-based algorithm, offering efficient upstream target selection by minimizing latency. The release also aligns with Gateway API v0.8.1, supporting TCPRoute and UDPRoute, and continues to develop advanced use cases like query string routing. The summit highlighted the enhanced capabilities of the Gateway API, encouraging users to explore its advanced routing features beyond the traditional Ingress resource.