Kong

Identify APIs and Desired Outcomes

The first step involves identifying the APIs that need to be managed and defining the desired outcomes of the implementation. This foundational step ensures that the Kong API Management setup aligns with the organization's business requirements

Installation and Configuration

The required infrastructure is set up, and Kong API Management is installed. This stage involves configuring the necessary settings, including APIs, plugins, and security measures, to align with the organization's business requirements. The support for tools like Insomnia in Theneo can be leveraged here to seamlessly import existing specs, making the transition smoother

API Integration and Testing

Existing APIs are integrated with Kong API Management, ensuring seamless communication between backend services and client applications. Thorough testing of the APIs is conducted to ensure they function as expected

Rollout and Monitoring

Kong API Management is gradually rolled out to different API consumers, ensuring minimal disruption to existing workflows. Performance, usage, and security of the APIs are monitored using the monitoring and analytics capabilities provided by Kong

Optimization and Customization

Kong API Management provides a range of customization options to tailor the platform according to specific business needs. This includes configuring plugins, fine-tuning security measures, and defining custom workflows. Continuous monitoring and maintenance are crucial to ensure optimal API performance and user experience

Migration from Kong Open Source to Kong Enterprise

For organizations migrating from Kong Open Source to Kong Enterprise, the process involves updating the running version of the Kong executable and ensuring the data store format is compatible. This migration enhances capabilities with additional features like Kong Manager, Secrets Management, Kong Developer Portal, and Kong Vitals

Plugin Architecture: Kong features a robust plugin architecture that allows users to extend and enhance the functionality of the Kong API Gateway. This includes plugins for authentication, rate limiting, transformations, logging, and more. Users can also develop custom plugins using Lua, which provides flexibility to implement specific API gateway policies and functionalities tailored to their business needs

Professional Services: Kong offers professional services exclusively to Kong Gateway Enterprise customers, which include custom services to extend and enhance the Kong platform. These services are designed to meet the unique requirements of an organization, ensuring that the Kong setup is optimized for specific business needs. This includes tailored enablement, instructor-led training, and best practices in architecture and deployment planning

Customization Options in Kong API Management Kong API Management provides a range of customization options to tailor the platform according to specific business requirements. This includes configuring plugins, fine-tuning security measures, and defining custom workflows. By customizing Kong API Management, businesses can ensure that the platform aligns seamlessly with their existing infrastructure and workflows

Support for Custom Plugin Development: Kong supports the development of custom plugins, giving users the power to implement specific API gateway policies in a plug-and-play fashion. This capability is further supported by resources such as Kong Academy, where users can learn about plugin development, testing, and automated delivery

Flexible Integration and Extensibility: Kong's open-source nature and its extensible platform make it highly adaptable for various business environments. It supports integration with multiple programming languages and environments, allowing for the creation of custom plugins and features that meet specific operational needs

Setup Fees: There is no explicit mention of setup fees in the sources provided. However, the complexity of the implementation and the need for professional services suggest that there might be costs associated with setting up Kong, especially for customized or large-scale deployments.

Maintenance and Support Charges: Kong's pricing includes the provision and maintenance of technical support, which covers both minor and major upgrades. This suggests that maintenance costs are likely included in the subscription fees, particularly for Kong Enterprise, which operates on an annual subscription model.

Support Services: Kong offers 24/7/365 support and professional services as part of the Kong Konnect Enterprise plan. This comprehensive support is designed to help businesses build and maintain custom environments. The cost of these support services is likely included in the higher-tier subscription plans.

Professional Services: Kong provides professional services, which include customized services to extend and enhance the Kong platform. These services are available exclusively to Kong Gateway Enterprise customers and are likely to incur additional costs depending on the specific services rendered.

Additional Usage Charges: Increased Usage Limits**: Customers can purchase increased usage limits during a subscription term at the same pricing as the underlying subscription, prorated for the portion of the subscription term remaining at the time the increased usage is added. Kong will invoice the customer for any excess or additional use, which suggests that there are additional costs for usage beyond the agreed limit.

Billing for Excess Usage: For monthly charges, Kong may bill more frequently for fees accrued if there is a risk of non-payment or if excessive usage is suspected. This indicates that customers might incur additional costs if their usage significantly exceeds typical levels.

License Management: Kong Enterprise licenses are based on the number of users, and the annual subscription includes technical support and upgrades. The cost of these licenses is dependent on the number of users registered and the specific needs of the business.

Kong Academy: Kong Academy provides a selection of courses with both self-paced and instructor-led training options. These courses are designed to help users understand and effectively use Kong products. The academy offers foundational courses, as well as more advanced training for developers, operators, and administrators of the Kong platform

Certification Program: Kong has developed a certification program that includes various certifications such as Kong Developer, Kong Mesh Operations Associate, and Kong Konnect Operations Associate. These certifications are intended to validate the skills and knowledge of users on the Kong platform. The program is supported by training courses that prepare users for certification exams

Instructor-Led Training: For users who prefer structured learning environments, Kong offers instructor-led training sessions. These sessions provide hands-on experience and direct interaction with knowledgeable instructors, enhancing the learning process

Self-Paced Online Courses: For those who prefer to learn at their own pace, Kong provides self-paced online courses available through Kong Academy. These courses cover various aspects of Kong's technology and are suitable for different levels of expertise

Community and Forum Support: Kong encourages users to join the Kong Nation forum and the Community Slack channel. These platforms allow users to discuss issues, share knowledge, and get answers to their questions from both the community and Kong's technical staff

Documentation and Resources: Kong maintains extensive documentation, including a developer guide, API documentation, and a Plugin Development Kit (PDK) reference. These resources are designed to help users understand how to configure and use Kong effectively

Support Services: Kong offers commercial support subscriptions that provide additional gateway functionality, commercial support, and access to managed platforms. These services are designed to help businesses maximize the value of their investment in Kong technology

Encryption: Kong facilitates SSL/TLS termination, which encrypts data in transit, protecting it from interception or tampering as it moves between clients and the server

Rate Limiting and Traffic Control: Kong provides dynamic rate limiting to control the rate of traffic and prevent abuse. This feature helps mitigate denial-of-service attacks and ensures that services remain available to legitimate users

Web Application Firewall (WAF): While Kong itself does not provide a WAF, it can integrate with external WAF providers like Akamai and Amazon Advanced Shield to protect against web attacks and enhance security

Bot Detection: This feature helps identify and block requests from bots that may attempt to perform denial of service attacks, ensuring that services are not disrupted by malicious automated traffic

Request Size Limiting: Kong can restrict the size of requests to prevent buffer overflow attacks and other forms of abuse that could lead to service disruption

Data Security Plugins: Custom plugins are available to protect against specific threats such as JSON/XML threats, enhancing the security of data being processed by the API gateway

Proxy Caching: This feature reduces the load on upstream services by caching responses, which not only improves performance but also helps in mitigating the impact of traffic spikes that could potentially lead to service outages

Security Extensibility: Kong’s flexible plugin architecture allows for the integration of additional security measures tailored to specific needs. This includes plugins for advanced authentication, encryption, and even custom security policies developed by third-party vendors

Kong typically releases updates for its software on a regular basis, with minor versions of the latest major release of Kong Enterprise being shipped every quarter

Long-Term Support (LTS) Versions: Kong designates certain minor versions as Long-Term Support (LTS) versions. These LTS versions receive up to three years of technical support, compared to the standard 12 months for non-LTS minor versions. This extended support period is particularly beneficial for enterprises that require stability and extended maintenance for their API management infrastructure

Sunset Support Policy: After the LTS support period, versions enter a sunset support phase for an additional 12 months. During this phase, Kong continues to offer support but prepares users for the eventual end of support, encouraging them to upgrade to newer versions

Direct Migration Support: For ease of upgrade, Kong supports direct migration between two adjacent LTS versions. This policy helps users plan and execute upgrades smoothly, minimizing disruptions to their operations

Release Testing and Documentation: Each release is accompanied by thorough testing and comprehensive documentation. Kong provides changelogs, upgrade guides, and other resources to help users understand the changes and how to implement them effectively. For example, the Kong Gateway changelog details new features, bug fixes, and deprecated features for each version, aiding users in keeping their deployments up to date and secure

Community and Enterprise Editions: Kong maintains both Community and Enterprise editions of its software. The Community Edition follows a similar versioning scheme but has a slightly different support policy, with minor versions typically supported until the next minor release. The Enterprise Edition, on the other hand, offers extended support for minor versions and LTS versions, catering to the needs of enterprise users.

Data Ownership

Kong's Privacy Policy specifies that personal data collected through their publicly available websites and services is managed in accordance with legal requirements and the company's data management practices. However, the policy does not explicitly use the term "data ownership" but implies that personal data is controlled by Kong in the context of providing its services and fulfilling its operational requirements

Data Portability

Kong acknowledges the importance of data portability, particularly for users in specific jurisdictions like the European Economic Area (EEA) and the United Kingdom (UK). The policy outlines that, subject to applicable law, users have the right to request the disclosure of personal information collected by Kong. This includes the right to receive copies of such personal information, which is a fundamental aspect of data portability. This enables users to obtain their data in a structured, commonly used, and machine-readable format, and possibly transfer it to another entity

Dynamic Scaling: Kong supports dynamic scaling, which allows organizations to scale their API gateway operations up or down based on current needs. This capability is crucial for organizations that experience fluctuations in demand, ensuring that they can efficiently manage resources without over-provisioning

Autoscaling: Kong's configuration includes autoscaling settings, such as `autoscaling. Target CPU Utilization Percentage`, which specifies the CPU utilization percentage that triggers autoscaling. This feature helps in automatically scaling the API gateway resources to maintain optimal performance without manual intervention

Load Balancing and Traffic Management: The implementation of load balancers is essential for effective scaling. Load balancers distribute incoming API traffic across multiple nodes in the Kong cluster, ensuring that no single node becomes a bottleneck. This distribution not only supports scaling but also enhances the reliability and availability of service

High Availability (HA) Setup: For organizations aiming for high availability, Kong can be configured in a cluster setup, which involves multiple instances of the API gateway running on separate servers. This setup allows for both horizontal scaling (adding more nodes) and vertical scaling (increasing resources within existing nodes), providing flexibility to handle increased loads or to scale down when demand decreases

Geographic Distribution: In a high-availability gateway cluster, nodes can be spread across different geographic locations. This geographic distribution helps in scaling by mitigating the risk of regional failures and ensuring that services remain available across different areas, thereby maintaining performance and reliability

Contract Renewal

Subscription Term: Each Order Form will terminate upon the expiration of the applicable Subscription Term unless expressly stated otherwise in the Order Form or in the agreement

Renewal Process: The agreement does not explicitly detail an automatic renewal process but implies that renewal occurs through mutual agreement, either by executing a new Order Form that references the agreement or through other means that extend the Subscription Term

Contract Cancellation

Termination by Customer: The Customer may terminate the Agreement by terminating all Cloud Services under their account. This suggests that customers have the option to end their subscription by discontinuing their use of Kong's Cloud Services

Termination by Kong: Kong may terminate the Customer’s account for any reason by providing the Customer with 30 days’ advance notice. This gives Kong the discretion to end the service agreement, provided they inform the customer in a timely manner

Fees Upon Cancellation: The agreement mentions that Kong calculates, and bills fees and charges as described on the site specific to the Kong Konnect Plus service. For monthly charges, Kong may bill more frequently for fees accrued if there is a risk of non-payment or if Kong suspects that the account is fraudulent. This implies that upon cancellation, any outstanding fees or charges accrued during the term of the service would likely be billed to the customer

Limitation of Liability: Notwithstanding anything in the Agreement to the contrary, Kong’s total liability to the Customer arising out of or related to the Kong Konnect Plus services under the Agreement is limited to the fees paid by the Customer to Kong in the twelve-month period prior to the event first giving rise to the liability. This limits Kong's financial liability to the customer in the event of service termination.

1SOC 2 Type II: Kong's information security practices have been audited and certified against the SOC 2 Type II standard, which focuses on security, availability, processing integrity, confidentiality, and privacy of a system

Cloud Security Alliance (CSA) Security, Trust, Assurance, and Risk (STAR) Level 1: Kong Konnect is assessed against CSA STAR Level 1, which involves a rigorous assessment of security practices against CSA’s Cloud Controls Matrix

Federal Information Processing Standards (FIPS) 140-2: Kong Gateway is compliant with FIPS 140-2, a U.S. government computer security standard used to approve cryptographic modules.