February 2024 Summaries

Kong Insomnia has introduced a new enterprise feature called Storage Control, which allows administrators to dictate the backend storage options developers can use for API assets such as collections, specifications, and authentication data. This enhancement aims to ensure API data security and compliance across digital businesses by enabling administrators to enforce specific storage settings, whether cloud-based, local, or on Git. By providing full control over storage locations, Storage Control enhances security and compliance across API portfolios for organizations, while offering the flexibility for different organizations to implement varied storage backend settings. This feature is now available by default for Insomnia enterprise customers and can be managed through the Enterprise settings in Insomnia accounts.

Kong has released Kong Gateway 3.6, focusing on transparency and trust by providing detailed performance benchmarks and open-sourcing its performance testing framework. These benchmarks, conducted on AWS infrastructure within a Kubernetes environment, highlight the gateway's throughput, latency, and scalability, showing capabilities such as handling up to 137,850.4 requests per second with minimal latency. By open-sourcing the testing suite, which includes tools like Redis, Prometheus, Grafana, and K6, Kong empowers users to independently verify performance claims and tailor tests to their needs. This initiative aims to equip developers and operational teams with the necessary tools and insights for informed API management, allowing for environment benchmarking, configuration validation, and reliability assurance. The release is part of Kong's commitment to continuous improvement and collaboration, encouraging users to engage with Kong Gateway 3.6 through Kong Konnect or explore further details in their documentation and changelog.

Karpenter is presented as a cost-effective solution for Kubernetes node autoscaling, improving the efficiency and cost of running workloads by evaluating resource requirements and selecting optimal EC2 instance types. Unlike traditional cluster autoscalers, Karpenter leverages AWS technologies like Amazon EventBridge and SQS to manage resources, using EKS Pod Identities for AWS service access. The blog post details the installation and configuration process of Karpenter, including the creation of NodePool and EC2NodeClass constructs for managing node constraints and AWS settings. It highlights the integration of Karpenter with Horizontal Pod Autoscaler (HPA) and the benefits of Cluster Consolidation, which optimizes resource usage by consolidating nodes into a more cost-effective configuration. The deployment of the Konnect Data Plane, alongside HPA and Karpenter, demonstrates improved scalability and resource management during high-load scenarios, emphasizing Kong's commitment to performance and elasticity in API gateway infrastructure.

In the evolving field of API management, there is a growing trend known as "the great unbundling," where enterprises are moving away from all-in-one solutions in favor of more specialized, componentized tools tailored to specific needs. Kong is actively participating in this shift with its "incremental buy-in" approach, allowing organizations to adopt and expand their API management tools as required, without committing to an entire suite upfront. This approach emphasizes flexibility, cost efficiency, reduced complexity, and future-proofing by enabling businesses to integrate new capabilities seamlessly as their needs evolve. A real-world example is Rabobank, which utilized Kong's platform to develop a customized API management system, starting with core tools and gradually incorporating additional components to address their specific operational requirements. By embracing this modular approach, Kong aligns with the industry's move towards more agile and adaptable API management solutions.

Kong Konnect has launched its Engineering Tech Blog to share insights and technical challenges faced by their team in developing and enhancing their API SaaS platform. The blog aims to provide valuable content to broaden the engineering expertise of its readers. Kong has been a part of the software and SaaS industry for several years, using core components like the Kong Gateway and its plugins to enhance platform resilience and functionality. The engineering team, known as the Konnect Village, is structured into four layers focusing on different aspects such as modules, deployment, platform services, and fundamental infrastructure. Engineers like Amy Abts, Drew Kimberly, Nick Anderson, and Mihai Peteu are highlighted for their contributions to various projects, including billing integration, the upcoming Service Hub, enhanced search capabilities, and frontend dashboards. The blog will also cover future topics such as a review of the Konnect architecture and the team's response to the HTTP/2 Rapid Reset Vulnerability. The initiative aims to foster a sense of community and recognition among engineers, emphasizing the impact of their work on customer experience and platform development.

API gateways serve as a crucial security component in the modern IT infrastructure by mediating between client applications and backend services, enforcing authentication, and managing access tokens through communication with authorization servers. These gateways can implement various client authentication methods, including the more secure mutual TLS (mTLS), which is essential for zero trust security frameworks. Kong, a prominent API gateway, supports all OAuth2.0 and OpenID Connect flows, including TLS Client Authentication, to enhance security by verifying both client and server certificates. Within these flows, Kong can securely fetch access tokens and proxy requests to backend services, making it vital for environments with stringent security requirements. By adopting mTLS, Kong helps organizations adhere to zero trust principles, ensuring that only authenticated and authorized entities can access sensitive resources.

The blog post explores the implementation and functionality of the Kubernetes Cluster Autoscaler within the Amazon Elastic Kubernetes Service (EKS), focusing on its role in dynamically adjusting the cluster size based on resource needs and node utilization. It explains how the Cluster Autoscaler works in conjunction with Amazon EC2's Auto Scaling Groups and emphasizes the importance of using IAM Roles for Service Accounts (IRSA) to ensure the autoscaler has the necessary permissions to manage resources effectively. The post outlines the process of deploying the Cluster Autoscaler using Helm charts and describes the configuration steps, including setting up a Kubernetes Service Account and IAM Role. It highlights the limitations of using the Cluster Autoscaler when dealing with multiple Node Groups with different instance types, suggesting that a more adaptable solution like Karpenter may be more suitable for complex scaling scenarios, which will be covered in the next part of the series.

Kong Gateway Enterprise 3.6 has been released, offering significant advancements in security, efficiency, and compliance for enterprise applications. Key features include the introduction of a Zero Trust architecture through mutual TLS client authentication, enhancing secure communication between API gateways and Identity Providers, and AppRole Authentication for Hashicorp Vault to streamline automated workflows and secrets management. The update also expands Consumer Groups support to more plugins, simplifying API management and reducing developer workload. Achieving FIPS certification with the Kong Cryptographic Module v1.0.0 underscores the commitment to high-security standards, ensuring data protection through industry-approved cryptographic algorithms. Furthermore, the release provides detailed performance benchmarks, which are open-sourced to foster transparency and community collaboration, making the update a strategic enhancement for enterprises.

Kong Gateway 3.6 is now available, introducing significant enhancements such as support for the Brotli compression algorithm, segment-based route matching, and improved observability, all aimed at boosting performance and efficiency. Brotli compression offers superior compression compared to traditional methods like gzip, enhancing application speed and reducing data transmission. The new route matching feature allows for more efficient URL handling without relying on resource-intensive regex, while increased observability provides actionable insights by revealing certificate expiration dates to prevent downtime. The release also includes Debian 12 artifacts, showcasing Kong's commitment to using reliable operating systems, and encourages users to explore the comprehensive features and updates available in the accompanying documentation and changelog.

Kong has launched six new open-source AI plugins in Kong Gateway 3.6, transforming every Kong Gateway deployment into an AI Gateway, enabling developers to integrate multiple large language models (LLMs) into their products more efficiently. The plugins include AI Proxy, AI Request/Response Transformer, AI Prompt Guard, AI Prompt Template, and AI Prompt Decorator, each designed to enhance AI and LLM usage by providing functionalities like multi-LLM integration, centralized AI credential management, L7 AI metrics collection, no-code AI integrations, advanced prompt engineering, and AI prompt firewall capabilities. Built atop Kong Gateway, these plugins offer high performance and low latency, essential for AI applications, while allowing orchestration of AI flows in cloud or self-hosted environments. They also leverage over 1,000 existing plugins for added features such as authentication, rate-limiting, and traffic control, making Kong's AI Gateway the most capable in the ecosystem. The plugins are supported by Kong's cloud platform, Kong Konnect, and Kong Gateway Enterprise, and users can get started with these new capabilities through demonstration videos and guides available from Kong.

The post discusses implementing Horizontal Pod Autoscaler (HPA) for Kubernetes Pods to achieve automatic horizontal scaling, contrasting it with Vertical Pod Autoscaler (VPA) and highlighting that they should not be used together for CPU or memory metrics. HPA, which updates workload resources in response to throughput demand, relies on metrics provided by the Kubernetes Metrics Server. The post details configuring HPA for a Konnect Data Plane deployment, including setting CPU and memory requests and replacing the NodeGroup with a smaller instance type to observe HPA in action. It describes a scenario where HPA creates new Pod replicas when CPU usage hits a 75% threshold, although resource limitations can lead to pending Pods. The post suggests using a cluster autoscaler, like Kubernetes Cluster Autoscaler or Karpenter on Amazon EKS, to address resource shortages and hints at further exploration of these tools in the series' next installment.

Kong Ingress Controller 3.1 introduces several enhancements aimed at improving the security and management of sensitive information within Kubernetes environments. New Custom Resource Definitions (CRDs) such as KongVault and KongLicense have been added, allowing for more streamlined handling of secrets and licenses. The KongLicense CRD enables the application or update of licenses directly through the Kong Admin API, eliminating the need to cycle pods for updates. The KongVault CRD provides integration with various secret management solutions like AWS Secrets Manager and Hashicorp Vault, enabling runtime injection of sensitive data. Additionally, the KongPlugin configuration has been enhanced to allow individual fields to be populated from Kubernetes secrets, simplifying the configuration process for operators. Furthermore, the introduction of the SanitizeKonnectConfigDumps feature gate ensures that sensitive data like certificate private keys remain within the cluster and are not sent to Konnect. These updates collectively enhance the security and operational efficiency of using Kong Ingress Controller with Kubernetes.

As digital transformation drives networks to the cloud, cyberattacks have become more frequent and sophisticated, exposing the limitations of traditional security models like VPNs and perimeter-based firewalls. To address these challenges, Zero Trust security frameworks and microsegmentation emerge as effective solutions. Zero Trust requires continuous verification of entities accessing applications, safeguarding networks from inside threats, while microsegmentation divides networks into smaller segments to control data access and prevent unauthorized lateral movement. This combination reduces the attack surface and enhances security by allowing organizations to implement granular policies tailored to specific workloads. Despite the complexities and challenges associated with microsegmentation, such as visibility, policy management, and scalability, its integration within Zero Trust frameworks offers robust protection for hybrid and multi-cloud environments. Tools with features like unified policy management, dynamic segmentation, automation, and real-time traffic monitoring are essential for maximizing the benefits of microsegmentation.

Empowering engineering teams while increasing velocity and maintaining security in API infrastructure requires a strategic balance between giving engineers autonomy over API policies and having a platform team manage the underlying infrastructure. Engineering teams should focus on developing products and iterating on API policies, utilizing infrastructure capabilities like traffic routing, feature flagging, and access to observability metrics. However, they should not handle infrastructure deployment, security configurations, and cross-cloud connectivity, as these are best managed by the platform team to prevent shadow IT practices and security vulnerabilities. By ensuring infrastructure and configuration segregation, organizations can streamline deployments and avoid inefficiencies, allowing engineers to innovate without compromising security. Kong provides such a solution by offering a unified control plane for managing API infrastructure, helping organizations maintain agility and security simultaneously.

The blog post explores how Kong Konnect Data Planes can utilize various autoscaling technologies on Amazon Elastic Kubernetes Services (EKS) 1.29 to efficiently manage API consumer demands while minimizing costs. The series is divided into four sections, focusing on Vertical Pod Autoscaler (VPA), Horizontal Pod Autoscaler (HPA), Cluster Autoscaler, and Karpenter, each offering distinct scaling benefits. Autoscaling is emphasized as a key feature of Kubernetes, providing the ability to automatically adjust resources in response to demand, either vertically by modifying hardware resources or horizontally by altering the number of nodes. The post details the setup of the Konnect Control Plane and Data Plane within an EKS cluster, demonstrating basic autoscaling use cases and explaining the role of VPA in adjusting Pod resources based on usage patterns. The article concludes by suggesting that while VPA offers broader trend insights for resource allocation, HPA could be more effective for rapid adjustments, with further exploration of HPA in subsequent posts.

As organizations increasingly adopt APIs, they face challenges such as shadow IT and infrastructure sprawl, often resulting from initial autonomy incentives. To address the growing API attack surface, technology leaders must enforce organizational accountability through security oversight, platform observability, and clear role definitions. Establishing robust processes and updating strategies are crucial to transitioning API infrastructure to a mission-critical status, thereby eliminating inefficiencies and enhancing resilience against cyber threats. Historically, the shift to microservices and Kubernetes was driven by the need for rapid iteration and success, yet this approach has led to inefficiencies and security challenges. To mitigate these issues, organizations must implement processes that empower security teams to oversee API configurations, enable platform teams to monitor services effectively, and allow application teams to focus on development rather than infrastructure management. As API attacks become increasingly sophisticated, it is vital for leaders to proactively secure their API environments, ensuring that internal inefficiencies do not become exploitable vulnerabilities.

Kong Mesh 2.6 introduces a range of features designed to enhance the flexibility, usability, and security of service mesh environments, facilitating easier adoption for new users and delivering a more powerful product. The update allows for smoother transitions from single-zone to multi-zone setups through federation, eliminating the standalone mode and enabling the addition of a global control plane at any time. Usability improvements include the default implementation of TargetRef policies and the MeshMetric policy, which enhance observability and allow for granular configuration of metrics, supporting open telemetry. On the security front, users can now manage policies directly within their zones, reducing reliance on the global control plane and allowing service owners more autonomy, while also integrating with Kubernetes and gitOps for policy management. Overall, Kong Mesh 2.6 aims to align with organizational goals by offering a versatile and reliable service mesh solution that leverages both on-premise and SaaS capabilities.