January 2024 Summaries

Kong Gateway Enterprise 3.2.x.x will enter its End Of Life (EOL) phase in February 2024, transitioning into a 12-month sunset support period dedicated solely to assisting customers in upgrading to current versions of Kong Gateway Enterprise, concluding in February 2025. During this sunset phase, while limited support is available for upgrade assistance, no software patches will be provided, necessitating customer upgrades to versions receiving active support for any required patches. Kong encourages customers to maintain a consistent upgrade schedule to supported versions, suggesting the latest Long-Term Support (LTS) version, 3.4.x.x, for those unable to upgrade annually.

The acceleration of microservices and containerized workloads has transformed software delivery, but also introduced complexities in networking, security, and observability, prompting the adoption of service meshes to manage these challenges. A service mesh provides a dedicated infrastructure layer for tasks like traffic control, access policies, and monitoring, freeing application code from infrastructure burdens and allowing developers to focus on business logic. By integrating seamlessly with container orchestrators and auto-injecting proxies, a service mesh simplifies deployment and management of distributed applications across hybrid or multi-cloud environments. Early adoption, or "Day 0" implementation, of a service mesh like Kuma helps manage cross-cutting concerns from the outset, preventing technical debt and easing scalability as the architecture grows, while tools like Kuma and Kong Mesh offer usability improvements to streamline the setup process. These solutions provide essential capabilities out of the box, such as mTLS and observability pipelines, enabling organizations to maintain reliable, secure connectivity and focus on core product development as they embrace cloud-native architectures.

Kubernetes has become the standard platform for deploying cloud-native applications, but networking and traffic management remain challenging, particularly with the limitations of the existing Ingress resource, which focuses mainly on Layer 7 HTTP/HTTPS traffic. Ingress simplifies external access management by centralizing control, but its lack of standardization and support for non-HTTP protocols, as well as advanced traffic management features, often leads to fragmentation and vendor-specific implementations. To address these issues, the Gateway API project introduces a set of new, portable network management resources designed to unify capabilities across different Ingress controllers, offering support for both Layer 4 and Layer 7 protocols, advanced traffic management features, and expanded rule customization. This new API aims to provide a standardized model that enhances portability, reduces vendor lock-in, and offers developers expanded declarative management capabilities. While the Gateway API will complement existing Ingress controllers, it is expected to gradually replace vendor-specific implementations with its comprehensive and flexible approach, supporting a wide range of use cases across both cloud and on-premise environments.

Kong Inc., a leader in cloud API technologies, has achieved accreditation from Singapore's Infocomm Media Development Authority (IMDA), marking a significant milestone that underscores the company's commitment to innovation and excellence. This recognition strengthens Kong's presence in Singapore's digital economy and enhances its position as a trusted vendor for government and enterprise customers across the Asia-Pacific region. The IMDA's rigorous accreditation process evaluates technical, financial, and operational aspects, confirming Kong's reliability in a competitive market. This achievement is expected to accelerate Kong's growth and streamline public sector engagements through the Tech Acceleration Lab and simplified procurement processes. With expansions like opening offices in Singapore and a joint venture with Japan Cloud, Kong is progressing towards its vision of an API-first world, supported by its unified cloud API platform. This platform integrates API management, service mesh, and ingress controller capabilities, trusted by global clients such as PayPal, GSK plc, and Nasdaq. The IMDA Accreditation reaffirms Kong's potential and future in leading and empowering organizations to adopt an API-first approach.

GraphQL offers flexible querying capabilities that enable the integration of data from multiple sources into a single endpoint, making it a valuable tool for building next-generation API platforms. However, this flexibility also introduces security vulnerabilities if not properly managed. At the API Summit 2023, Tristan Kalos and Antoine Carossio highlighted the security risks associated with GraphQL, based on their analysis of over 130,000 public endpoints, culminating in The State of GraphQL Security 2023 report. They discovered nearly 50,000 security alerts, with 10% classified as critical, pointing out that GraphQL's powerful features, such as batching and aliasing requests, can be exploited to bypass rate limiting and facilitate brute-force attacks. Additionally, the graph structure of GraphQL can obscure access control, inadvertently exposing sensitive data through multiple access paths. The research identified common vulnerabilities including brute-force attacks, denial of service from recursive fragments, schema leaks, and injection vulnerabilities. These issues highlight the overlap with classic API vulnerabilities like broken authentication, access control issues, and the exposure of sensitive data, emphasizing the need for rigorous security practices to protect GraphQL services.

In the context of modern applications and cloud-native architectures, service meshes have emerged as essential tools for efficiently managing microservices communication, security, and observability. They are particularly beneficial for organizations undergoing application modernization, platform upgrades, cloud migration, multi-cloud operations, multi-tenancy, and implementing Zero-Trust security programs. Service meshes enable developers to offload complex networking tasks, streamline operations through GitOps methodologies, and enforce robust security policies across diverse computing environments. Two prominent service mesh solutions, Kuma and Kong Mesh, offer varying levels of functionality and support, with Kuma being an open-source, easy-to-operate option and Kong Mesh providing enterprise-grade features with advanced automation and integration capabilities. Both solutions emphasize the importance of traffic management, resilience, telemetry, and security, aiding organizations in achieving seamless service connectivity and consistent application of security policies across multiple platforms and regions.

Open Banking is a global movement that leverages API connectivity to transform traditional banking experiences, allowing customers to engage with financial services through various platforms rather than being confined to legacy channels. While different countries have adopted Open Banking with varying approaches, the UK pioneered its implementation in 2018, leading to significant advancements in data sharing, particularly with accountancy platforms like Sage and Xero. This shift has facilitated seamless bookkeeping and financial planning by eliminating the need for manual data handling. Despite its success in data sharing, Open Banking faces challenges in the payments sector due to performance and consistency issues, which hinder its competitiveness against established credit card systems that offer instant payment fulfillment. The technology infrastructure's reliability is crucial for Open Banking's success, with solutions from companies like Kong and OBconnect playing a vital role in enhancing the performance and security of these systems. While Open Banking promises enhanced data accessibility, innovation, and personalized financial services, its adoption is uneven across different sectors, necessitating improvements in technology to unlock its full potential.

Kong Gateway plays a crucial role in the Open Banking ecosystem by helping financial institutions navigate regulatory compliance and leverage opportunities in a data-driven landscape. It enables enhanced data accessibility, interoperability, and scalability, facilitating seamless integration and personalized financial services through standardized APIs. This fosters innovation and competition, benefiting consumers with more choices and better services. Kong ensures secure, compliant API management, supporting features like Dynamic Client Registration and Mutual-TLS Authentication, critical for maintaining data privacy and consumer trust under regulations like GDPR and PSD2. Additionally, Kong aids banks in transitioning from monolithic systems to microservices architectures, enhancing development efficiency and operational savings, as exemplified by First Abu Dhabi Bank's increased API usage and reduced costs. The platform also improves partner onboarding and collaboration through its Developer Portal, allowing banks to explore new ideas swiftly with third-party partners. Overall, Kong's robust security, governance capabilities, and adaptability make it indispensable in the evolving Open Banking ecosystem and the broader vision of Open Finance.

The article details a transformation in Kong's approach to frontend development by adopting a micro frontend architecture, using Vue.js to enhance scalability, maintainability, and developer experience. Initially, the monolithic structure of Kong Konnect's Vue Single-Page Application facilitated rapid feature deployment for a smaller team but eventually led to workflow bottlenecks as the application grew. By transitioning to a micro frontend architecture, Kong's teams achieved autonomous, team-based development, reduced bottlenecks, and enhanced scalability. The new setup includes a developer-optimized monorepo, shared core logic, and standardized testing patterns, which resulted in significantly faster build and release times and improved code quality. The article also highlights the trade-offs faced during this transition, such as maintaining two code versions temporarily and requiring a full page load when navigating between micro frontends. The use of GitHub Actions, S3, and CloudFront for build and deployment processes further streamlined workflows, contributing to a more efficient and scalable development environment at Kong.

Kong Konnect has introduced a new EKS Blueprint Add-on for Mesh Zones, which facilitates the deployment of Kong Mesh through its Mesh Manager on Amazon EKS. This add-on aims to streamline the installation process by providing an opinionated setup that integrates with AWS Secrets Manager and leverages Terraform for Infrastructure as Code best practices. The architecture involves deploying global control planes in the Mesh Manager, with zones acting as remote control planes within infrastructures like EKS. These zones ensure connectivity across service meshes, enabling microservices to operate seamlessly across different zones as if they were on a single network. The add-on simplifies the configuration process, abstracting complex AWS and Kubernetes interactions by integrating with the External Secrets Operator to manage secrets securely. This setup aligns with the AWS Well-Architected Framework's security principles, ensuring data is managed with least privilege access, and supports automation with features like secret rotation and encryption. The goal is to allow users to quickly deploy and manage Kong Mesh zones on EKS, adhering to AWS best practices while minimizing manual configurations.

Kong Konnect, a unified API management platform, is now available through the Google Cloud Marketplace, allowing organizations to manage multiple gateways across various environments, such as on-premises, hybrid, cloud, and multi-cloud, with ease. This availability enables users to utilize their Google Cloud committed spend for transactions while benefiting from Kong Konnect's API management tools. To get started, users can subscribe through the Google Cloud Marketplace, which integrates billing with their Google Cloud account, and access a basic plan that supports up to 10 services and 100 million API requests. Kong Konnect is also available on Amazon Web Services and Microsoft Azure, providing enterprises with secure, scalable API service management. Additional resources such as webinars and virtual sessions are available to help technology leaders effectively utilize Kong Konnect for API lifecycle management. For custom pricing or specific business needs, potential customers are encouraged to contact Kong's sales team for further assistance.