https://wenhan.blog/en/tags/kong/ Recent content in Kong on Wenhan blog Hugo -- gohugo.io en-US Thu, 01 May 2025 23:49:19 +0900 https://wenhan.blog/en/posts/20250501_konnect_ecs_gui/ Thu, 01 May 2025 23:49:19 +0900 https://wenhan.blog/en/posts/20250501_konnect_ecs_gui/ This article introduces how to deploy microservices using AWS ECS (Elastic Container Service) Fargate as the Data Plane for Kong Konnect and build an API Gateway environment. Prerequisites AWS account Kong Konnect account Setup Steps On the Kong Konnect Side Log in to Konnect, go to Gateway manager -> Data Plane Nodes -> Configure data plane, and click Generate Certificate to generate a docker run command. Copy the parameters from this command, as you will use them later. https://wenhan.blog/en/posts/20250415_kong_serverless/ Tue, 15 Apr 2025 23:49:19 +0900 https://wenhan.blog/en/posts/20250415_kong_serverless/ Pre-function Plugin Explained with Practical Example Kong Gateway is a multifunctional API gateway, but did you know you can embed lightweight serverless functions directly inside it? This time, we’ll introduce a practical example using Lua scripts to extract a UUID from the request body, add it to the header, and output it to the log. What is the Pre-function Plugin? As described in the official documentation, the pre-function plugin is a flexible feature that allows you to write Lua code to process requests before they are sent to the API. https://wenhan.blog/en/posts/20250325_kong_graphql_mngm/ Tue, 25 Mar 2025 23:49:19 +0900 https://wenhan.blog/en/posts/20250325_kong_graphql_mngm/ Review of GraphQL GraphQL is an API query language developed by Facebook that provides a more flexible way to retrieve data compared to traditional REST APIs. Features of GraphQL Single Endpoint: While REST APIs require multiple endpoints, GraphQL allows you to send different queries to a single endpoint (/graphql). Fetch Only Needed Data: Clients can specify only the fields they need, preventing unnecessary data transfer. Type System: The API schema is defined with types, making the data structure clear. https://wenhan.blog/en/posts/20241224_kong_101_mtls/ Tue, 24 Dec 2024 23:49:19 +0900 https://wenhan.blog/en/posts/20241224_kong_101_mtls/ Security in API communication is extremely important for maintaining system reliability. This article provides a detailed explanation of how to configure mTLS (Mutual TLS) using Kong API Gateway. In particular, it covers how to set up mTLS for the two communication paths: “Client -> Kong” and “Kong -> Upstream API”. Basics of mTLS mTLS is an extension of TLS (Transport Layer Security) in which both sides of the communication (client and server) authenticate each other using certificates. https://wenhan.blog/en/posts/20241223_kong_101_req_res_trans/ Mon, 23 Dec 2024 23:49:19 +0900 https://wenhan.blog/en/posts/20241223_kong_101_req_res_trans/ Introduction In modern application development, APIs are a crucial foundation for integrating with other systems and services. However, challenges such as mismatched API requirements, differing data formats, and unmet security requirements frequently arise between different systems. In such situations, leveraging an API gateway is the most effective way to flexibly modify requests and responses. An API gateway like Kong Gateway is more than just an API management tool. It provides powerful features to customize the content of requests and responses as it controls the flow of traffic. https://wenhan.blog/en/posts/20241216_kong_jwt_ultra/ Mon, 16 Dec 2024 23:49:19 +0900 https://wenhan.blog/en/posts/20241216_kong_jwt_ultra/ (https://tech.aufomm.com/the-ultimate-guide-of-using-jwt-with-kong/ translated) :::note This article may not be the truly “ultimate” guide, but it aims to thoroughly explain the official Kong plugins available for JWT validation. By the end, you should have a comprehensive understanding of the available options and be able to choose the best plugin for your use case. ::: Background JSON Web Tokens (JWT) are essential in web development, serving as a secure way to transmit important information between systems. https://wenhan.blog/en/posts/20241206_kong_101_proxy_caching/ Fri, 06 Dec 2024 23:49:19 +0900 https://wenhan.blog/en/posts/20241206_kong_101_proxy_caching/ Introduction The main purposes of caching in an API gateway are as follows: Fast response Reduced backend load Cost savings First request flow (upper section): The client sends a request to Kong Gateway Kong Gateway forwards the request to the backend (upstream service) Kong Gateway receives the response from the backend and saves it as a response cache The response is returned to the consumer Second request flow (lower section): https://wenhan.blog/en/posts/20241203_kong_101_ratelimiting/ Tue, 03 Dec 2024 23:49:19 +0900 https://wenhan.blog/en/posts/20241203_kong_101_ratelimiting/ The Importance of Rate Limiting In today’s API economy, rate limiting plays a crucial role in system stability, security, and cost efficiency. Here’s a detailed explanation of its importance. Server Load Management APIs can receive unpredictable amounts of requests. For example, a sudden surge in popularity or unexpected traffic spikes can overload servers. By setting rate limits, you can control the maximum number of requests and ensure the server maintains proper performance. https://wenhan.blog/en/posts/20241201_kong_101_service_route/ Sun, 01 Dec 2024 23:49:19 +0900 https://wenhan.blog/en/posts/20241201_kong_101_service_route/ When using Kong Gateway, “Service” and “Route” play crucial roles. A Service defines the destination for API requests, while a Route specifies the rules for mapping those requests to the Service. What is a Service? A Service defines the information of an external API or microservice that Kong Gateway proxies. Specifically, you configure the destination URL, hostname, port, protocol, etc., to which requests are forwarded. For example, if you want to proxy a backend “User API” with Kong, you register that API as a Service. https://wenhan.blog/en/posts/20241029_konggw_rke2/ Tue, 29 Oct 2024 23:49:19 +0900 https://wenhan.blog/en/posts/20241029_konggw_rke2/ This article is a memo on the steps to install Kong on RKE2. Installing RKE2 RKE2 Server 1 2 3 4 5 6 7 8 9 10 root@ip-10-0-25-27:~# curl -sfL https://get.rke2.io | sh - [INFO] finding release for channel stable [INFO] using v1.30.5+rke2r1 as release [INFO] downloading checksums at https://github.com/rancher/rke2/releases/download/v1.30.5+rke2r1/sha256sum-amd64.txt [INFO] downloading tarball at https://github.com/rancher/rke2/releases/download/v1.30.5+rke2r1/rke2.linux-amd64.tar.gz [INFO] verifying tarball [INFO] unpacking tarball file to /usr/local root@ip-10-0-25-27:~# systemctl enable rke2-server.service --now Created symlink /etc/systemd/system/multi-user. https://wenhan.blog/en/posts/20230308_using-sops-and-age-deploy-konggw/ Thu, 09 Mar 2023 16:41:18 +0900 https://wenhan.blog/en/posts/20230308_using-sops-and-age-deploy-konggw/ Background When deploying Kong Gateway, there is some data that we do not want to store in plain text, such as connection information to the database. The Kong Secret Manager was developed to solve this problem, which can be solved using a 3rd party service such as AWS Secrets Manager. However, this functionality is unavailable when the environment does not allow connection to external security services. In this case, we can use a encryption tool SOPS, developed by Mozilla to do the encryption and decryption.