Centralizing security policies with the Kong API Gateway

When a company grows, the number of systems grows with it, and generally it becomes harder and harder to get homogeneous security features across the various services or applications. In this talk we'll discuss how an API Gateway (Kong) can help bringing that back to a maintainable state.

Transcript

1. Centralizing security policies with an API gateway
2. /whois • • • • • • •
3. The origins: a Majestic Monolith © Current Web Architecture: sandbox Majestic Monolith rate- limit logs authz auth Heavy Business Logic Shiny Features https mainte nance IP limit
4. Load Balancer / Reverse Proxy More tools, more services Current Web Architecture: sandbox Historical Monolith rate- limit logs authz auth Heavy Business Logic Shiny Features mainte nance IP limit Shiny New Service authz auth More Features https Admin tool authz auth Useful Tooling! Internal tool auth CI Jobs IP limit waf dos
5. A few years later Current Web Architecture: sandbox
6. How to improve that? • ◦ ◦ ◦ • ◦ ◦ ◦ ▪ ▪ Kong ▪
7. Kong: open-source / enterprise API Gateway source: https://konghq.com/
8. Components: what is Kong anyway? • • • • ◦ ◦ ◦ ◦ ◦
9. Kong API Gateway Target architecture Load Balancer Historical Monolith rate- limit logs authz mainte nance IP limit Shiny New Service https Admin tool Internal tool waf dos kongdb 5" authz auth
10. Plugins • • ◦ ◦ • ◦ ◦
11. Bundling third party plugins # Dockerfile FROM kong:0.14.1 ENV USER=root PATH=$PATH:/usr/local/openresty/bin ENV KONG_CUSTOM_PLUGINS=external-oauth <... deps ...> ADD ./plugins /plugins RUN cd /plugins/external-oauth && luarocks make
12. Sample architecture Kong API Gateway rate- limit kongdb auth Sample app Kong Demo app.internal:8080 kong-admin:8001 kong-demo.yeah:80 kong-proxy:80
13. Add service % curl -X POST http://kong-admin:8001/services/ \ --data "name=kong-demo" \ --data "url=http://app.internal:8080" {"host":"app.internal","created_at":1537871796,"connect_timeout":60000,"id": "5ca1605b-304b-4c50-9ae0-8639d7c7185e","protocol":"http","name":"kong-demo", "read_timeout":60000,"port":8080,"path":null,"updated_at":1537871796,"retrie s":5,"write_timeout":60000}
14. Add route % curl -X POST http://kong-admin:8001/services/kong-demo/routes \ --data "hosts[]=kong-demo.yeah" \ --data "preserve_host=true" {"created_at":1537872153,"strip_path":true,"hosts":["kong-demo.yeah"],"prese rve_host":true,"regex_priority":0,"updated_at":1537872153,"paths":null,"serv ice":{"id":"5ca1605b-304b-4c50-9ae0-8639d7c7185e"},"methods":null,"protocols ":["http","https"],"id":"b5aff8ee-028e-4e5d-a5d3-26d05210b1a3"}
15. Add plugin: rate-limiting % curl -X POST http://kong-admin:8001/services/kong-demo/plugins \ --data "name=rate-limiting" \ --data "config.second=1"
16. Demo
17. Our opinion so far • ◦ ◦ ◦ ◦ ◦ • ◦ ◦ ◦ ◦
18. Tooling • ◦ ◦ • ◦ ◦ ◦ ◦
19. Alternatives • ◦ ◦ ◦ ◦ ◦
20. The end