November 2023 Summaries

Kong Gateway Enterprise 3.1.x.x will transition out of Full Support by December 2023 and enter a Sunset Support phase until December 2024, according to the company's support policy. During this Sunset Support phase, Kong will offer limited assistance to help customers upgrade to a fully supported version but will not issue patches for this version. Customers are advised to upgrade to a supported version, with the recommendation to move to the latest Long-Term Support (LTS) version, which is 3.4.x.x, if they cannot consistently upgrade within a 12-month period.

API gateways are crucial for ensuring the security, availability, and responsiveness of APIs, and maintaining robust gateway configurations is essential. The decK 1.28 update introduces a new feature that enables native validation of gateway configurations against custom rule sets, enhancing compliance with best practices and fortifying gateway deployments. This feature integrates linting capabilities, a process often used to detect potential errors and deviations from coding standards, directly into the decK command line tool, facilitating seamless integration with CI/CD pipelines. The deck file lint command functions as a flexible JSON/YAML linter, enabling users to create rules that filter and validate file contents using JSONPath syntax. It allows for defining severity levels and output formats, adding versatility to the command. For example, users can ensure that only secure https protocols are used in Kong Gateway configurations by applying a specific ruleset. The command's success or failure is indicated by return codes, which help in aborting processes if violations are detected, thus preventing problematic configurations from reaching production environments. The implementation relies on the GoLang-based Vacuum library, and further documentation and examples are available for APIOps and Kong-specific use cases, with additional resources accessible through the Kong Konnect platform.

Kong Mesh 2.5 introduces a range of features focused on enhancing flexibility, resiliency, and security, making it a compelling choice for service mesh solutions. By adopting Delta KDS as the default, Kong Mesh improves resource efficiency, performance, and scalability by optimizing resource synchronization and reducing overhead. Resiliency is bolstered through locality-aware load balancing, which ensures high availability, cost optimization, and compliance across multiple zones by maintaining traffic within zones and setting strict routing rules. In terms of security, the Reachable Services Inference through MeshTrafficPermission simplifies configuration management and enhances service mesh performance by pruning unreachable services, leading to faster proxy responses. Overall, Kong Mesh 2.5 equips organizations with a robust toolset to meet objectives related to resource efficiency, reliability, cost management, compliance, and security, encouraging users to explore its capabilities through demos or downloads.

Access tokens, or bearer tokens, are crucial in token-based architecture for granting clients access to protected resources, but they pose security risks if stolen, allowing unauthorized access by bad actors. A solution to enhance security is the use of sender-constrained tokens, which bind tokens to the client's cryptographic keys, ensuring only the rightful owner can use them. This approach, known as proof of possession, addresses vulnerabilities by requiring the client to prove authorization through a cryptographic process, such as mutual TLS (mTLS). Implementations like Kong Gateway Enterprise 3.5 support certificate-bound access tokens via mTLS, ensuring that the client certificate matches the token's thumbprint, enhancing security in environments with high requirements such as financial services, e-health, and e-government. This method aligns with the requirements of financial API (FAPI 2.0) and provides a robust defense against token misuse by verifying the legitimacy of the token bearer.

Kong Gateway Enterprise 3.5 introduces significant security enhancements, particularly in secrets management and the Open-ID Connect (OIDC) plugin, to cater to enterprise customer demands. This release notably includes the integration of Azure Key Vault, expanding Kong's existing support for AWS Secrets Manager, GCP Secrets Manager, and HashiCorp Vault, thereby making it the first cloud-neutral API gateway with comprehensive support for secrets management across all three major public cloud providers and HashiCorp. This unique stance sets Kong Gateway apart, as other vendors, often owned by cloud providers, cannot claim similar cloud neutrality. The updates also encompass key security improvements for AWS integrations, reinforcing Kong Gateway Enterprise's position as a leader in the industry, regardless of the cloud environment in which it operates.

Kong Gateway 3.5 for Open Source (OSS) has been released, featuring enhancements such as improved WebAssembly support, which allows JavaScript developers to extend the gateway, and significant upgrades in observability and performance. The WebAssembly beta in this release offers better performance, easier configuration, and supports a wider range of languages, including AssemblyScript. Kong Gateway 3.5 introduces a unique request identifier, `X-Kong-Request-Id`, aiding in debugging by correlating requests with logs. The release also includes a feature for on-demand request timing information to quickly diagnose latency issues, and a dedicated configuration processing capability in hybrid mode to eliminate resource contention. Additionally, the CORS plugin now supports private network access, aligning with changes in Chrome 117, which reduces the burden of managing CORS for developers. The release encourages feedback from users to further refine these features.

APIs play a pivotal role in modern software architecture by enabling communication across applications and services, especially in environments adopting microservices. Modern API platforms, such as Kong Konnect, address the shortcomings of legacy systems by offering a distributed architecture with centralized control, infrastructure-agnostic deployment, automated configuration, and developer self-service. These features facilitate governance, security, and scalability, allowing organizations to manage APIs efficiently throughout their lifecycle. Legacy solutions often suffer from tight coupling, centralization issues, and manual processes, which impede adaptability and visibility. Conversely, platforms like Kong Konnect provide a federated operating model, enhancing decentralized management while maintaining oversight, and integrate with service meshes to ensure consistent traffic management. With capabilities such as a centralized API catalog, automation tools, and comprehensive analytics, Kong Konnect offers a robust framework for building and managing APIs at scale, promoting a seamless and secure API ecosystem.

Kong is expanding its presence in the Japanese market through a joint venture with Japan Cloud, a Tokyo-based consultancy known for aiding high-growth cloud companies in Japan. This strategic move involves establishing a local subsidiary in Tokyo, aiming to leverage Japan's position as the world's third-largest economy and a leading enterprise software market. The partnership will combine Japan Cloud's local expertise with Kong's innovative API management technology to facilitate the transformation of Japanese enterprises into API-first leaders, aligning with the country's swift adoption of agile development practices. Kong's commitment to this expansion is underscored by the establishment of the Tokyo subsidiary, which is set to capitalize on the growing demand for API-first solutions among businesses ranging from startups to Fortune 500 companies, including notable clients like Yahoo! Japan operator LY Corporation.

The Kubernetes Gateway API is a significant advancement in Kubernetes networking, developed collaboratively by multiple vendors and community members to provide a robust and extensible standard for managing ingress traffic. Officially released in version 1.0.0, the Gateway API aims to enhance and simplify ingress management by introducing routes as separate APIs, allowing for more granular control over traffic routing at both L4 and L7 layers, and addressing limitations in the existing Ingress API. It introduces new resources like Gateway, GatewayClass, and Route, and improves upon the Ingress API by offering capabilities such as HTTP header matching, HTTP method matching, and cross-namespace references. The Gateway API also standardizes API customizations through the PolicyAttachment specification, enhancing its flexibility and functionality for real-world use cases. Additionally, tools like ingress2gateway facilitate the transition from the Ingress API to the Gateway API, making it easier for users to adopt this new standard. With its general availability, the Gateway API is positioned as the future of Kubernetes networking, offering a stable and mature solution for production environments.

The Gateway API has emerged as a pivotal innovation in Kubernetes networking, succeeding the Ingress API to address its limitations and foster greater collaboration across the community. Initiated at the San Diego KubeCon in 2019, the project aims to create a more generic, expressive, and extensible solution for Kubernetes users, using Custom Resource Definitions (CRDs) to allow for flexible deployment without altering the core codebase. The Gateway API provides multiple interoperable APIs—GatewayClass, Gateway, HTTPRoute, TCPRoute, and UDPRoute—each catering to different roles and needs in Kubernetes environments, thus surpassing Ingress in functionality with added features like enhanced matching criteria and security capabilities. The project gained significant traction between 2020 and 2022, with more than 20 implementations supporting it and becoming a focal point at industry events like KubeCon. A notable advancement was the inclusion of the "Gateway API for Mesh Management and Administration (GAMMA)" sub-project, which expanded its use beyond ingress to service mesh contexts. The culmination of community efforts led to the release of the Gateway API's first generally available version, v1.0.0, in 2023, cementing its role as a foundational element of future Kubernetes networking and setting the stage for continued development and enhancement.

Kuma 2.5.0 introduces significant advancements, including the default implementation of the Delta KDS protocol, which enhances efficiency by transmitting only changed resources between global and zone control planes, rather than entire snapshots. This transition occurs seamlessly, with the option to revert to the previous version for a limited time. The release also debuts a locality-aware load balancing API, offering refined traffic control within and across zones to optimize reliability, compliance, and cost savings. Additionally, improvements in MeshTrafficPermission for Reachable Services inference aim to boost performance by simplifying proxy configurations, especially in environments where access needs to be tightly controlled. The update marks the general availability of TargetRef-based policies, which have been refined for greater expressiveness and power, allowing users to define complex constraints more effectively.

Kubernetes introduced the Ingress API in 2015 to manage cluster traffic, but it was eventually surpassed by more advanced tools like Kong Gateway. This led to the development of the Gateway API, launched at KubeCon San Diego in 2019, which has now achieved General Availability (GA) status. The Gateway API enhances Kubernetes with support for L4 traffic, advanced routing capabilities, and vendor-neutral configuration, facilitating data portability and enabling developers to work seamlessly across platforms. It represents a significant shift towards open standards, driven by a collaborative effort among companies such as Google, Kong, VMware, and Isovalent. Kong, a major contributor to the project, offers the Kong Ingress Controller which integrates these capabilities, demonstrating the Gateway API's potential to redefine API gateway functionalities within Kubernetes. The project underscores the principles of open source, with community-driven development leading to an industry-standard solution.