April 2025 Summaries

The convergence of API management and event-driven architectures (EDA) is gaining traction, as highlighted by Kong's emphasis on unifying the API and eventing developer experience through its Event Gateway and API platform. Industry analysts like Gartner and Forrester have long predicted this trend, which aims to integrate API and event management to streamline processes and reduce redundancy. Historically, organizational silos between API and event teams have hindered this unification, but the rise of platform teams focused on breaking down these barriers is changing the landscape. With the introduction of Kong Konnect, the platform offers tools for exposing event broker resources as API products, facilitating easier access to real-time data while maintaining security and efficiency. This approach enables developers to leverage both REST and real-time data sources, fostering innovation and improving customer experiences. Kong's initiative represents a broader shift towards integrating APIs and events within a unified platform, addressing the growing need for cohesive management in the era of hybrid and multi-cloud architectures.

Open source software plays a vital role in modern software development due to its cost benefits, flexibility, and collaborative potential, yet it presents unique security challenges that require a comprehensive vulnerability management strategy. This strategy involves identifying, assessing, and mitigating security risks associated with open source components, aiming to minimize the potential attack surface and protect organizations from breaches. Effective management includes maintaining an accurate inventory of open source components, continuously monitoring for vulnerabilities, assessing risks, and implementing timely remediation measures. Collaboration among development, security, and operations teams is essential, along with embedding security considerations into every phase of the software development lifecycle. Automated tools and continuous integration within development workflows enhance vulnerability detection and resolution, while fostering a security-conscious culture through education and training strengthens organizational defenses. Establishing robust patching processes, integrating security audits, and maintaining compliance with industry standards are crucial for a resilient security framework. Collaboration with the open source community and fostering a DevSecOps culture further embed security into organizational practices, ensuring that security is a fundamental component of the development process.

The rapid development of AI-native applications is marked by continuous innovations in building AI-centric solutions, involving various tools such as the Model Context Protocol (MCP) and the Agent2Agent Protocol (A2A) for streamlining communication in agentic applications. These applications involve interactions between multiple entities, including user-facing interfaces, autonomous agents, MCP servers, and large language models (LLMs) like OpenAI and Bedrock. Integrating these components presents challenges such as managing authentication, enforcing rate limits, and ensuring detailed observability while maintaining flexibility and security against misuse. Kong's AI Gateway offers an enterprise-grade solution designed to address these challenges by securing and governing the connectivity between AI-native applications.

In the SaaS industry, ensuring tenant isolation is crucial for maintaining data security and operational efficiency in multi-tenant environments. Kong addresses this challenge by employing various database strategies, such as separate databases, shared databases with separate schemas, and shared databases with shared schemas, each with its own trade-offs regarding resource requirements and data isolation. The implementation of row-level security (RLS) in PostgreSQL is highlighted as a refined approach to maintain tenant data isolation by applying security checks at the row level, ensuring that queries are processed only for authorized data. Kong uses a microservice architecture and leverages tools like Golang and TypeScript to facilitate the adoption of RLS, ensuring seamless integration and secure data handling. The article emphasizes the importance of strong testing frameworks to ensure smooth transitions to RLS and the necessity of internal tools to automate tenant scoping in database queries, ultimately advocating for RLS as a robust solution for tenant data security.

Kong's integration with Terraform through its Konnect platform offers a streamlined approach to managing API gateways across multiple cloud providers, such as AWS, Azure, and GCP, by using infrastructure as code. This automation reduces manual errors and ensures consistency and repeatability across different environments, facilitating multi-cloud deployments with global reach. The use of Kong’s Dedicated Cloud Gateways (DCGW) provides isolated, high-performance API gateways on dedicated infrastructure, combining the benefits of a hosted solution with the autonomy of cloud-region deployment. By defining API configurations, routes, policies, and governance rules in Terraform, teams can achieve version control, auditability, and reduced dependency on individual expertise, leading to faster deployment times and cost efficiency. This approach not only enhances scalability and compliance but also transforms API management from a manual process to a more efficient, automated, and auditable system.

APIs are pivotal for business disruption and innovation, and Kong Konnect aims to enhance this by offering a platform that supports API discovery, governance, and consumer management, while prioritizing developer experience. Recent updates include the Service Catalog with Scorecards for governance, providing a central repository for API visibility and compliance management. The platform also introduces advanced analytics and Active Tracing for real-time API performance monitoring and troubleshooting. The new Developer Portal focuses on improving API adoption by optimizing developer experience, while Custom Dashboards allow users to tailor insights for strategic decision-making. Enhanced consumer management reduces operational overhead by allowing centralized configuration of consumer data, improving performance with real-time data fetching and caching. Overall, Kong Konnect consolidates API and connectivity management in a single platform designed to support current needs and future strategies.

Role-based access control (RBAC) is a security framework that helps organizations manage data access by assigning permissions based on predefined user roles rather than individual users, which enhances security, operational efficiency, and regulatory compliance. By enforcing principles such as least privilege access, separation of duties, and integration with single sign-on (SSO), RBAC minimizes the risk of unauthorized access and data breaches while simplifying administrative tasks. It is increasingly adopted across industries like healthcare, DevOps, and finance to protect sensitive data and ensure compliance with regulations. To implement RBAC effectively, organizations should clearly define user roles and responsibilities, plan a staged rollout, manage personnel changes, and conduct regular access reviews to prevent security risks. While RBAC offers significant benefits, challenges such as overcomplicating role structures or ignoring role overlap can pose risks if not addressed properly. Tools like Kong Gateway can facilitate RBAC implementation by providing a centralized platform to enforce policies consistently across APIs, enhancing both security and scalability.

"Docs as Code" is an innovative approach that applies software development methodologies to documentation, emphasizing the importance of version control, automation, and collaboration to maintain accurate and up-to-date documentation. By treating documentation like code, using tools such as Git for version control, and incorporating CI/CD pipelines, this approach aligns with modern DevOps and Agile practices, allowing documentation to evolve alongside rapid software changes. It fosters collaboration by enabling developers, writers, and other stakeholders to work together seamlessly, ensuring consistency and reducing errors through peer reviews and automated testing. This methodology also addresses the challenges of traditional documentation, such as outdated content and collaboration chaos, by providing a structured, automated, and scalable way to manage technical content. For API-driven and fast-paced development environments, "Docs as Code" offers significant advantages, such as improved accuracy and efficiency, ultimately leading to better user experiences and measurable business benefits.

Retrieval-Augmented Generation (RAG) is an innovative approach that enhances large language models (LLMs) by enabling them to access and integrate real-time external data, significantly improving the accuracy and relevance of their responses. RAG addresses the limitations of traditional LLMs, which rely on static datasets with cutoff dates, by allowing AI systems to retrieve and synthesize up-to-date information on demand. This capability is crucial for enterprises in fast-paced environments that require real-time, context-rich, and reliable AI insights, such as customer support, healthcare, legal services, and financial analysis. By combining the power of LLMs with the freshness and depth of external data, RAG mitigates risks associated with outdated information, enhances decision-making, and ensures compliance in regulated industries. It reduces the need for constant model retraining, offering cost efficiency while maintaining high performance. As the technology advances, RAG is poised to transform AI applications across various sectors by providing more accurate, adaptable, and scalable solutions, with potential future developments including multi-modal retrieval, recursive retrieval, and hybrid search strategies.

Observability has become crucial for effective application and system performance monitoring, focusing on understanding a system's internal state through real-time data analysis, thus enabling proactive optimization and management. Unlike traditional monitoring that only signals problems, observability helps identify their root causes by utilizing logs, metrics, and traces. This approach is especially beneficial at the API gateway layer, which serves as a central traffic management point across distributed services, offering insights into request patterns, response times, and error rates. Implementing observability at the API gateway layer aids in mapping service dependencies and provides essential business metrics. The blog post discusses the integration of Kong Konnect with Dynatrace using the OpenTelemetry (OTel) framework to enhance observability. OpenTelemetry, an open-source framework, facilitates the collection and export of telemetry data like traces, metrics, and logs. The OTel Collector, a key component, processes and exports telemetry data efficiently. Kong Konnect's deployment with Dynatrace is illustrated through a simple e-commerce application, demonstrating the integration's ability to manage and monitor microservices effectively. The post also details the process of setting up Kong Objects, configuring plugins, and employing both code-based and zero-code instrumentation to achieve comprehensive observability, ultimately enhancing system performance, security, and user experience.

Recent API and data security breaches have highlighted the importance of implementing robust security measures throughout the API lifecycle, starting from design and testing phases. To address these concerns, Kong has integrated Kong Insomnia into its API platform, enhancing security features compared to tools like Postman. Insomnia focuses on collection governance and role-based access control (RBAC) to prevent unauthorized access and data leaks, ensuring API collections are not publicly accessible by default and allowing administrators to manage permissions and sync settings. It offers flexibility in data storage, allowing users to store data locally, via Git, or in the cloud, which is crucial for organizations with strict compliance requirements. Insomnia also provides seamless integration with third-party vaults such as AWS Secrets Manager and Azure Key Vault for secure secrets management, and offers end-to-end encryption for cloud-stored data, ensuring encryption is handled client-side. Supported by Kong's expert team, Insomnia provides comprehensive documentation and 24/7 support, making it a robust solution for securely managing APIs across their lifecycle.

Software development has evolved significantly with the adoption of microservices, leading to the rise of new tools and frameworks such as OpenTelemetry, a prominent open-source observability standard. Emerging in the early 2010s, microservices shifted architecture away from monolithic applications towards smaller, independent services, necessitating tools like Kubernetes for container management and API gateways for cloud application traffic. OpenTelemetry has quickly become the de facto standard for monitoring, tracing, and logging across microservices architectures, simplifying instrumentation and offering a unified framework by merging OpenCensus and OpenTracing. Distributed tracing, a method to track requests through multiple services, is crucial for understanding modern applications' performance, and OpenTelemetry enhances this by integrating tracing with logging and metrics for comprehensive insights and faster troubleshooting. The framework's vendor-agnostic API, SDKs, collectors, and exporters allow seamless integration with various observability tools, ensuring interoperability and promoting ecosystem growth. Since its introduction, OpenTelemetry has seen widespread adoption across industries, offering organizations deep insights into their microservices' performance and reliability, thereby enhancing user experiences and system robustness.

Kong has been recognized as the top-ranked API management tool on G2's Momentum Grids for Spring 2025, earning the highest user satisfaction in the categories of API Management and API Development. Users praise Kong for its scalability, extensibility, and ease of use, highlighting its lightweight, plugin-based approach that enhances API management by allowing modular customization without altering the core system. The tool is especially valued for its support of hybrid and multi-cloud environments, its optimization for microservices, and its secure connections across distributed architectures. Additionally, Kong's intuitive user interface and straightforward installation make it accessible even for beginners, with features like the Kong Ingress Controller for Kubernetes praised for simplifying Ingress and Routing. Kong Konnect is noted for enabling organizations to manage APIs effectively, enhancing agility, scalability, and governance for digital initiatives, with users encouraged to explore its capabilities further through demos and reviews on G2.

A RESTful API is an application programming interface that adheres to Representational State Transfer (REST) principles, offering a standardized method to design web APIs using common web technologies. RESTful APIs are favored for web and mobile applications due to their simplicity, scalability, and ability to work across diverse platforms. They utilize standard HTTP methods such as GET, POST, PUT, and DELETE to manage resources, which can be represented in formats like JSON or XML. The stateless nature of RESTful interactions, where each request is independent, enhances efficiency and reliability. RESTful APIs also support caching to improve performance and are designed to be self-documenting for ease of use. Although REST is often contrasted with SOAP, REST’s lightweight, flexible architecture makes it a popular choice for modern applications connecting to microservices. It is compatible with many programming languages and platforms, and it incorporates authentication and security practices like API keys and OAuth 2.0 to ensure safe access to resources. RESTful API design emphasizes a uniform interface, statelessness, cacheability, and a layered system architecture for scalability and robustness.

Observability is essential for understanding and optimizing the performance and health of applications and systems, offering a deeper insight compared to traditional monitoring by analyzing system-generated data in real-time to determine not only when issues occur but also their root causes. Implementing observability at the API gateway layer, such as with Kong Konnect, enhances performance, security, and visibility across an organization's API ecosystem. It allows for comprehensive monitoring, faster issue detection, and improved security by tracking request patterns, response times, and potential threats. OpenTelemetry, an open-source observability framework, provides the standards for collecting telemetry data like metrics, logs, and traces, which can be further analyzed using solutions like Dynatrace. Dynatrace integrates with OpenTelemetry to simplify cloud operations, enhance security, and improve digital experiences through automation and intelligent insights. When combined, Kong Konnect and Dynatrace, leveraging OpenTelemetry standards, mark a significant advancement in observability architectures, enabling organizations to implement robust policies and achieve comprehensive visibility and control over their infrastructure.

Kong AI Gateway 3.10 introduces significant enhancements aimed at improving AI governance and developer productivity, primarily through automated Retrieval-Augmented Generation (RAG) to reduce large language model (LLM) hallucinations and comprehensive PII sanitization to ensure data privacy. The new AI RAG Injector plugin automates data retrieval processes, minimizing developer workload while increasing response accuracy by providing LLMs with vetted information. The update also includes built-in support for sanitizing personally identifiable information across multiple languages, offering a reliable and scalable solution to maintain compliance and protect user data. Additionally, the release enhances model consumption with native SDK support, allowing seamless integration with existing client libraries and facilitating easier migration to Kong's platform. The introduction of cost-based load balancing optimizes AI model usage based on token consumption and cost, while the expanded support for vector databases with pgvector offers flexibility in storing embeddings. These updates collectively enable organizations to streamline AI operations, enhance security, and more efficiently manage AI workloads.

Kong Inc., a rapidly growing company, provides a dynamic environment ripe with opportunities for career advancement, as illustrated by the experiences of three standout Account Executives: Thomas Charbon, Yasmine Ghandour, and David NunnTelfort. These individuals highlight key strategies for thriving in such an environment, emphasizing the importance of excelling in one's current role, strategically promoting oneself for career growth, being vocal about career aspirations, and demonstrating patience and consistent performance. They also stress the value of leveraging community support and mentorship, as no one advances alone. Their collective experiences underline that career progression in a fast-paced company results from dedication, relationship-building, and active involvement in personal growth, offering insights applicable to anyone aiming to succeed in a high-velocity professional setting.

Efficient PII sanitization is essential for integrating large language models (LLMs) and agentic AI into enterprise workflows, particularly in regulated or sensitive data environments. Despite their capabilities, LLMs pose privacy challenges as they are not inherently privacy-aware, often retaining and potentially exposing sensitive information. To mitigate these risks, PII sanitization should be embedded into AI workflows from inception, rather than added as an afterthought. Current ad-hoc solutions, such as regex-based redaction, lack consistency and scalability, prompting the need for more structured approaches like AI gateways. These gateways function similarly to API gateways, providing control, visibility, and policy enforcement while abstracting PII sanitization from developers, thus reducing human error and focusing on core AI functionality. Kong's AI Gateway exemplifies this by integrating PII sanitization as a standard policy, which is crucial for maintaining compliance, trust, and efficient data management. This approach supports broader AI innovation by ensuring secure and compliant data handling, ultimately facilitating faster market deployment and enhancing business value.

AI is revolutionizing business operations, but challenges like hallucinations in large language models (LLMs) remain due to their reliance on static datasets. Retrieval-Augmented Generation (RAG) is a method gaining traction to mitigate these issues by providing LLMs with real-time access to domain-specific data, thereby enhancing response accuracy. RAG involves two main phases: data preparation, which organizes and embeds unstructured data into a vector database, and retrieval and generation, where relevant data is fetched to generate accurate responses. Despite its benefits, RAG implementation can be complex and time-consuming, prompting solutions like the Kong AI Gateway to automate and streamline this process, ensuring consistent, secure, and high-quality AI outputs. This approach is particularly vital in sectors such as healthcare, law, and finance, where precise information is critical, and allows organizations to operationalize AI strategies more effectively by reducing errors and improving governance.

MCP offers a novel approach to integrating large language models (LLMs) and AI agents with third-party data sources and APIs by providing a centralized interface that eliminates redundant code and facilitates shared tool access for multiple agents. The release of Kong’s MCP Server for the Kong Konnect platform enables customers to leverage AI agents to query LLMs for real-time discovery of APIs, services, and traffic analytics, as well as access complex configurations from federated control planes within organizations. This integration allows users with the necessary credentials to easily understand the organization's API portfolio, monitor real-time API usage, and manage policy configurations, thereby enabling the development of new business intelligence solutions through AI agents and chat interfaces.

Kong Gateway Operator (KGO) 1.5 introduces enhancements that simplify installation, scaling, and management of Kong Gateway or Kubernetes Ingress, with a focus on improved integration with Kong Konnect. The update allows for the universal application of plugins across control planes, simplification in referencing Konnect control planes, and configuration improvements such as enhanced custom CA certificates to meet security requirements. New features include more descriptive service configurations, improved resilience through multi-replica KIC ControlPlane deployment, and new Prometheus metrics for better observability and performance monitoring. The release also addresses security concerns by replacing the deprecated kube-rbac-proxy with a built-in metrics access filter, aligning with Kubernetes-native practices. Users are encouraged to upgrade from version 1.3 or older to 1.4.1 before moving to 1.5 to avoid migration issues, and they are invited to discuss these innovations at KubeCon Europe in 2025.