Kong

Kong is an API gateway platform for routing, securing, and observing API traffic.

Centralizes API access control, authentication, rate limiting, and traffic policies.

Provides a single controlled entry point for many backend services.

OSS provides core gateway features; enterprise adds advanced governance/analytics features.

Proxy nodes handling live API traffic.

Management/configuration plane distributing policies/routes to data planes (mode dependent).

Represents an upstream API/service abstraction.

Defines how incoming requests match and map to a Service.

Host, path, method, headers, SNI (depending protocol/config).

Logical load-balanced pool of backend targets.

Individual backend endpoint (IP/host:port) inside an Upstream.

Clear decoupling of traffic entry, policy, and backend resolution.

Reusable policy/filter extending gateway behavior.

Rate limiting, key-auth, JWT, OIDC, ACL, CORS, request-transformer, logging.

Identity entity representing API client/app/user.

Attach credentials, ACLs, and per-client policies.

Auth material linked to consumer (API key, JWT secret, cert, etc.).

YAML/JSON config defining gateway state (DB-less workflows common).

DB mode stores config in database; DB-less loads full declarative state directly.

Simplicity, GitOps friendliness, and immutable config patterns.

API for managing gateway configuration and entities.

It controls traffic/security policies for entire gateway.

Web UI for managing Kong entities (edition/feature availability varies).

Kong handles HTTPS and forwards to upstream over configured protocol.

Select certificate based on requested server name.

Require client certificates for strong mutual authentication.

Manage browser cross-origin request policies centrally.

Throttle requests per consumer/ip/credential/window.

Protect upstreams from abuse and accidental overload.

Modify headers/body/path/query before upstream forwarding.

Adjust outbound responses for compatibility/security needs.

Export request/response metadata to observability systems.

Max connect/read/write time before gateway aborts request.

Prevents hung connections and preserves gateway capacity.

Gateway retries failed upstream requests under configured rules.

Can amplify load during partial failures if misconfigured.

Avoid routing to repeatedly failing targets (implementation/plugin/pattern dependent).

Active/passive checks determining target availability.

Route traffic only to healthy backends.

Round-robin, least-connections, consistent-hashing (capabilities vary by setup/version).

Use hashing/cookies to keep client routed consistently.

Session continuity vs uneven distribution risk.

Putting all APIs/routes/plugins in one unmanaged shared namespace.

Exposing Admin API publicly.

Private admin plane, TLS everywhere, least-privilege credentials.

Multiple gateway replicas and upstream health checks.

Track latency, status codes, throughput, auth failures.

Standard route naming/plugin baseline templates.

Tool for declarative config sync/diff for Kong state management.

GitOps-style versioned, repeatable gateway configuration workflows.

Managed control-plane/SaaS style management offering (feature availability dependent).

Operational simplification and centralized governance.

Logical configuration isolation for teams/tenants.

Reduce multi-team blast radius and config collisions.

Treat gateway config as code with PR reviews.

Separate ingress traffic concerns from service business logic.

Platform team defines guardrails, app teams onboard via templates.

Document 401/403/429/5xx gateway triage playbooks.

Start simple with standardized plugin bundles.

Run Kong as critical edge infrastructure, not just proxy middleware.

Multiple plugins can interact; order affects final behavior.

Auth, transform, and rate-limit precedence changes outcomes/security.

Global applies to all traffic; scoped applies to service/route/consumer.

Fine-grained policy without unintended platform-wide impact.

Group-based policy assignment for multiple consumers.

Allow/deny API access based on consumer group membership.

API key lookup vs token signature/claims validation.

Delegate authentication/authorization to identity provider via OIDC flows.

Centralized auth integration for many APIs.

Token validation/caching/introspection settings must match risk and scale.

Block oversized payloads to protect upstreams/resources.

Rate limits, IP reputation, auth hardening, anomaly controls.

Route subset traffic to new upstream targets by weights/headers.

Switch routes/upstream targets from old to new environment.

Send copy of traffic to shadow upstream for validation.

Test new versions without affecting client responses.

Gateway authenticates to upstream with client certs.

Protect service-to-service data and identity, not just edge traffic.

Avoid downtime while renewing many certs/keys.

Automate issuance, staged deployment, and expiry alerting.

Per-route custom plugins without standard baseline controls.

Global minimum security baseline + scoped additive overrides.

Live gateway config differs from Git-declared desired state.

Regular diff/sync and CI policy checks before apply.

Kubernetes controller translating Ingress/Gateway resources into Kong config.

Unified gateway policies with K8s-native declarative workflows.

KIC derives from K8s resources; standalone often direct Admin API/declarative config.

Custom resources expressing plugins/consumers/routes beyond basic Ingress.

Modern K8s traffic API often supported via controller integration patterns.

Versioned schema migrations must be coordinated during upgrades.

Separated control plane and data plane communication architecture.

Central config governance with distributed low-latency data planes.

Control/data plane mTLS and cert lifecycle must be robust.

Local vs central counters affect consistency/performance tradeoffs.

Cache improves latency but affects revocation immediacy.

Per-route latency percentiles, plugin error rates, upstream health trends.

Propagate trace context and export spans for end-to-end visibility.

Identify edge vs upstream latency contributors quickly.

Prevent sensitive headers/tokens/PII leakage to logs.

Private admin/control plane, strong authN plugins, mTLS where needed.

HA gateway clusters, health checks, tested failover.

Config-as-code, policy linting, approval workflows.

Teams onboard APIs through standardized templates with low incident rate.

Optimize plugin usage and logging volume to control overhead.

Segment traffic domains and avoid one massive shared gateway when needed.

Use canary config rollouts for high-risk gateway changes.

Separate external, partner, and internal API gateway lanes.

Platform team owns paved road; API teams own service contracts.

Audit API access policy changes and credential lifecycle events.

Design upstream fallback and timeout budgets explicitly.

Move legacy edge logic incrementally into gateway policies.

Automated tests for route matching and auth/rate-limit behavior.

Promote gateway config from dev to prod with immutable artifacts.

Treat every plugin/config update as security-relevant change.

Use workspaces/projects/namespaces for team isolation.

Classify failures by edge auth, routing, upstream, or platform layer.

Define latency/error objectives per API class at gateway edge.

Enforce minimum TLS and auth requirements by default.

Load test peak traffic with plugin stack enabled.

Continuously remove one-off route exceptions.

Document golden plugin combinations and anti-patterns.

Restrict who can modify global plugins/routes.

Automate cert/key/client credential rotation schedules.

Correlate gateway metrics with upstream app SLOs.

Build Kong as a governed API platform, not ad-hoc proxy config.

Balancing central governance with team autonomy across many APIs and regions.

Regional data planes with centralized or federated control planes.

Serve traffic simultaneously from multiple regions for resilience/performance.

Primary region handles traffic; secondary takes over on failure.

DNS/GSLB/CDN directs clients to healthy/nearest gateway region.

Misconfiguration can affect every connected data plane/API.

Scoped workspaces, staged rollouts, policy validation, regional segmentation.

Compromised custom/community plugin can execute at critical edge path.

Signed artifacts, code review, restricted plugin allowlist, runtime hardening.

Strong identity verification and least privilege for every request path.

Gateway enforces coarse authN; services enforce domain-specific authZ.

Business-context authorization often requires service-local logic/data.

Improper downstream token propagation can widen privilege exposure.

Audience scoping, token minimization, short TTL, secure header handling.

Sensitive payload/header logging and transformation leakage.

Redaction, field-level masking, minimal log retention, encrypted transport/storage.

Cataloging APIs, plans, quotas, and lifecycle controls (tooling/edition dependent).

Rate/quota tiers and consumer entitlements for partner/public APIs.

One tenant/API consumes disproportionate resources affecting others.

Isolation pools, resource limits, per-tenant quotas, dedicated gateways.

RPS, p95/p99 latency, connection counts, plugin CPU overhead, error budget burn.

Complex chains can significantly increase latency/cost.

Inject upstream failures, latency spikes, cert issues, and CP/DP disconnects.

Validate resilience and fail-safe behavior under realistic faults.

Data planes continue with last-known config; drift/change propagation pauses.

Alerting, config freeze policies, reconnection runbooks.

Backup config/state, restore control plane, verify data plane sync and cert trust.

Edge outages affect all APIs; untested recovery is high risk.

Automated checks ensuring route/plugin/security compliance before deployment.

No public route without auth, TLS required, no unsafe plugins globally.

Apply changes to subset gateway nodes/routes before fleet-wide rollout.

SLO degradation or auth/routing error spike after release.

Unified metrics/logs/traces with per-route, per-consumer, per-plugin visibility.

Measure change safety/velocity and operational reliability of edge platform.

Audit trail of policy changes, credential issuance, access decisions, incident actions.

Separate platform admins, security policy approvers, API publishers.

Embedding excessive business transformations in gateway layer.

Gateway handles cross-cutting concerns; business logic stays in services.

Consistent policy and identity across heterogeneous networking environments.

Standardized config pipelines and environment-specific controlled overlays.

Gateway must fail predictably and preserve core API availability under stress.

Every edge path must enforce strong auth, transport security, and least privilege.

Standardize API onboarding with automated guardrails and auditable exceptions.

Design for isolation domains matching risk, tenancy, and traffic profile.

Continuously test upgrades, failover, and rollback at platform scale.

Platform and API teams co-own consumer experience and security posture.

Segment gateways before shared-control complexity becomes bottleneck.

Retain tamper-evident logs for auth, policy, and admin actions.

Optimize plugin chains and upstream interactions using real traffic data.

Protect control plane and config pipeline as crown-jewel assets.

Treat gateway capabilities as internal product with roadmap and SLAs.

Move legacy edge controls incrementally with measurable safety gates.

Plan for region, control-plane, and upstream dependency failures explicitly.

Prefer declarative, tested, Git-driven gateway operations.

Kong excellence is secure, observable, and governable API traffic control at scale.