August 2024 Summaries

Ngrok has enhanced its Kubernetes Operator by incorporating support for Kubernetes Load Balancer services, which simplifies establishing TCP and TLS connectivity to applications within Kubernetes clusters. Previously, users relied on ngrok’s custom TCPEdge and TLSEdge resources, which were complex and prone to errors. With the new Load Balancer support, users can leverage a Kubernetes-native method that provisions external load balancers and communicates external IPs or hostnames to services, streamlining the process of exposing services like the example ngrok-ascii telnet server to the internet. This development eliminates the need to allocate node ports, as ngrok uses an outbound tunnel to manage traffic, enhancing security by allowing only outbound traffic. Additionally, the integration with external-dns facilitates DNS management, making it easier to provide consistent service connectivity across environments, whether on-premises or in the cloud. Overall, this upgrade supports a more straightforward, secure, and versatile approach to managing ingress traffic in Kubernetes environments.

You can configure ngrok's Traffic Policy module to block unwanted traffic from search engine bots and AI bots by using three options: blocking all bots with a `robots.txt` file, blocking specific bots by user agent, or restricting IPs with CIDRs. The first option prevents future bots from constantly pinging your service, while the second option ensures specific bots can't ignore your robots.txt and crawl your content. The third option blocks bots alongside other public internet traffic. Implementing all three options in sequence provides the utmost guarantee that your apps, services, and APIs are available to trusted peers.

Leveraging ngrok for traffic management offers significant advantages, such as detailed visibility into network traffic and the ability to export audit and traffic logs to external systems. Recently, ngrok introduced the capability to send logs directly to Azure Monitor via the Logs Ingestion API, simplifying the process of sending logs for further processing and storage with just a few clicks. Minimax, a leader in fire protection, utilizes ngrok for device connectivity and appreciates the enhanced network visibility and security compliance it provides. Configuring Azure Monitor integration in ngrok requires setting up an Azure Logs Workspace, Entra Application, and Data Collection Rule, followed by creating an event subscription in the ngrok Dashboard. A newly published guide assists users in navigating this setup. The new Azure Logs event destination joins ngrok's existing AWS Kinesis and Datadog options, with support channels available for user inquiries.

Deploying applications on AWS EC2 instances often necessitates a secure and efficient method for internet access, protection from DDoS attacks, and additional features like authorization or geo-aware content. Traditional reverse proxy solutions like nginx or Caddy present challenges such as complex configurations, SSL certificate management, regional limitations causing latency, scalability issues, and lack of effective DDoS protection. In contrast, ngrok offers a modern and streamlined approach, functioning as a lightweight agent that manages public traffic ingress without complicated setups, automates certificate management, provides built-in DDoS protection, and enables scalability. It also supports caching, geo-aware failover, cloud-based observability, and easy activation of features like redirects and authentication. Setting up ngrok involves creating an AWS EC2 instance, installing ngrok, and configuring it with an authtoken, allowing it to serve as a reverse proxy for applications running on the instance. This setup is further enhanced by the ability to establish a permanent URL via a custom domain, demonstrating ngrok's capacity to simplify reverse proxy configurations on AWS with minimal maintenance.

Ngrok has introduced a user experience enhancement to its dashboard, simplifying the process of configuring DNS records for those who bring their own domains and utilize nested subdomains. This update includes a new zone switcher element that allows users to easily select the appropriate DNS zone and generate the correct target DNS records for their provider, eliminating errors and guesswork associated with CNAME records. While this change doesn't manage DNS zones within ngrok itself, it reduces the complexity involved in adhering to established naming conventions and logic. The improvement is part of ngrok's ongoing efforts to incorporate user feedback and streamline networking tasks for developers. The update has been credited to the contributions of frontend software engineer Melanie.

ngrok's Traffic Policy Module uses Common Expression Language (CEL) variables to help developers create policies that shape or manipulate traffic based on information embedded within every connection, request, and response that passes through the endpoint. Connection variables contain information about the raw connection between a client and the ngrok endpoint, including geographic origin, TLS usage, and connection timestamp. These variables can be used to target specific traffic and dynamically apply policies, such as filtering connections by IP address or geo-based location, and interpolating content into upstream headers or logs. The module also allows developers to create custom responses during planned maintenance using a combination of CEL expressions and connection variables.

To implement mutual TLS (mTLS) with ngrok's API gateway, you need to generate public and private keys for a certificate authority (CA), create a self-signed CA certificate, and then generate certificates for your client. You configure the ngrok agent to terminate TLS on the server and reject all requests missing a certificate signed by your CA. To verify mTLS is configured correctly, send a request without passing the client's certificate and check for a TLS error response. With mTLS enabled, you can access your API with a certificate and private key, establishing non-repudiation in how API consumers interact with your service. ngrok provides a free account to help meet security best practices, saving you from configuring web servers or deploying custom DNS, and enabling you to get to production quickly without complex reverse proxies or wrestling with your ops team. Once mTLS is enabled, you can extend your API gateway goodness with additional policies and a developer-first configuration workflow.

Ngrok's Traffic Policy engine serves as an API gateway, enabling users to modify traffic behavior through actions like header addition, response compression, and JWT validation. It also facilitates URL rewriting and redirection, which are vital during API migrations. For instance, when transitioning from version 1 to version 2 of an API, the Traffic Policy engine can automatically redirect traffic to the updated endpoints or rewrite URLs without client awareness. Redirects inform clients of endpoint changes via HTTP status codes and require an additional client request, while URL rewrites offer a seamless experience by modifying URLs before reaching the server. Utilizing ngrok's cloud endpoints for these actions eliminates the need for maintaining separate infrastructure, acting like serverless functions. The Traffic Policy engine supports various configurations and integrates with other services, with resources available for deeper exploration and community support.

The text discusses the concept of developer "groove," emphasizing the importance of consistent processes like development environments, version control, and CI/CD pipelines in building applications. It highlights the challenges developers face with traditional API gateways when deploying APIs, such as cumbersome authentication processes and lack of customization, which can disrupt the developer workflow. The concept of APIOps is introduced as a methodology that integrates DevOps and GitOps principles to streamline API development, allowing for version-controlled configurations and repeatable deployments. The text illustrates how using tools like ngrok's API gateway can resolve these issues by providing a unified and developer-friendly ingress that supports APIOps workflows. This approach offers benefits such as environmental independence, global acceleration, and enhanced developer autonomy, enabling a smoother and more efficient API development process.

Ngrok is focused on creating seamless developer experiences by ensuring that IT, security, and compliance users can easily understand how their platform operates. When using ngrok, data transmitted through its tunnels, such as proxied data, is managed with customizable security controls, including HTTPS and zero-knowledge encryption. Stored data includes IP addresses, machine details, and browser information, with options for extended data capture through features like Traffic Inspector and Full Capture mode. Ngrok divides its operations into a control plane, hosted in a US-based AWS region, and regional data planes located globally, allowing customers to choose their data routing paths. Security is a priority, with TLS 1.2 or higher securing internet traffic, and data at rest being encrypted. Customers have control over data retention and can delete their data anytime. Ngrok uses third-party providers for some services and maintains a vendor management program to ensure compliance and security, with detailed information available through their Trust Center.