Kong

Introduction to Kong Gateway

Kong Gateway is an API Gateway built on NGINX and developed in Lua. It acts as the entry point between API consumers and backend services, playing the role of an advanced reverse proxy with powerful capabilities for managing, securing, and observing traffic. Its purpose goes far beyond forwarding requests. Some of the native capabilities it provides are: Authentication and authorization through mechanisms such as API Keys, JWT, Basic Auth, or OIDC. Traffic control through rate limiting policies, quotas, and allow lists. Request and response transformations without changing the applications. Event, metric, and trace logging to improve observability. Centralized exposure of multiple services through a single entry point. Thanks to this approach, APIs can focus exclusively on business logic while Kong Gateway takes care of common concerns such as security, traffic control, observability, and communication handling.

Sunday, July 26, 2026 | 5 minutes Read

Installing Kong with Docker (Hybrid Mode)

Introduction In this article we will deploy Kong Gateway 3.10 open source in Hybrid mode using Docker Compose. This architecture, based on the separation between the Control Plane (CP) and the Data Plane (DP), is one of the deployment models recommended by Kong for API Gateway environments because of its flexibility, scalability, and high availability. In a Hybrid deployment, only the Control Plane maintains a direct connection to the database and is responsible for managing the full gateway configuration through the Admin API and Kong Manager. The Data Planes, on the other hand, run in DB-less mode and automatically receive configuration from the Control Plane through a secure channel protected by mTLS. This allows the Data Planes to keep processing traffic even if the Control Plane or the database becomes temporarily unavailable.

Sunday, July 26, 2026 | 22 minutes Read

Installing Kong Ingress Controller (KIC)

In this article, we will move from theory to a real deployment. The goal is to install Kong Ingress Controller (KIC) in a Kubernetes cluster, verify that Kong Gateway is working properly, and prepare the external exposure of the proxy so that we can publish applications from the cluster itself. To keep the lab simple, I will use a single virtual machine created with Vagrant on which I will run a k3s cluster. This choice does not change the way Kong works, but it allows us to focus on what really matters: what KIC installs, why the proxy service initially appears in Pending, and how to solve that with MetalLB.

Sunday, July 26, 2026 | 9 minutes Read

Basic Auth in Kong

Basic Authentication may seem like a trivial mechanism because it only uses a username and a password. However, using it correctly means separating three ideas: the HTTP standard, the validation performed by Kong Gateway, and the identity that Kong associates with valid credentials. In this article we will look at those three layers and build a reproducible lab with Kong Ingress Controller. The goal is not simply to copy files and blindly apply them. First we will understand what each resource represents, then we will apply it, and finally we will check what happens inside Kong.

Sunday, July 26, 2026 | 8 minutes Read

Key Auth in Kong

An API key may look like little more than a random string that a client adds to every request. To use it correctly, however, it helps to separate three ideas: the credential presented by the client, the validation performed by Kong Gateway, and the identity of the Consumer associated with that credential. This article covers those three layers and builds a reproducible lab with Kong Ingress Controller. We will first understand each resource, then apply it, and finally verify what happens inside Kong.

Sunday, July 26, 2026 | 8 minutes Read

HMAC Auth in Kong

HMAC Authentication proves that a request was created by a client that knows a shared secret without sending that secret in the request. In addition to authenticating the client, the signature detects changes to the signed elements while they are in transit. This article explains how an HMAC signature is built and validated by Kong Gateway, and how the Consumer relates to its credential. We then build a reproducible Kong Ingress Controller lab and protect /hmac-auth.

Sunday, July 26, 2026 | 7 minutes Read

JWT Auth in Kong

A JSON Web Token carries claims about an identity inside a signed token. Kong can verify its signature and time constraints before the request reaches the backend. This article separates the token structure, the cryptographic credential stored in Kong, and the Consumer representing the client. We then build a reproducible Kong Ingress Controller lab with an HS256-signed JWT and a /jwt route. This lab continues directly from Installing KIC. It reuses the kong Gateway, the echo Service, and the 192.168.121.200 address assigned by MetalLB to kong-gateway-proxy.

Sunday, July 26, 2026 | 7 minutes Read

OAuth 2.0 Token Introspection in Kong

Kong Enterprise includes an official OAuth 2.0 Introspection plugin, but it requires a license. In this lab, we will overcome that limitation by installing an open community or free-software plugin on Kong Gateway 3.10. In addition to the plugin, we will deploy Keycloak in Kubernetes. Keycloak will issue access tokens through client_credentials and expose the introspection endpoint defined by RFC 7662. Every response shown in this article comes from this real scenario.

Sunday, July 26, 2026 | 9 minutes Read

OpenID Connect in Kong

Kong’s official OpenID Connect plugin requires an Enterprise license. In this lab, we use the open community or free-software cuongntr/kong-openid-connect-plugin adapter on top of lua-resty-openidc to complete an Authorization Code flow without a license. We will deploy a separate Keycloak instance in Kubernetes, log in with a real user, and verify both the callback and cookie reuse. Every response in this article comes from the lab VM. This lab continues from Installing KIC. It reuses the kong Gateway, the echo Service, KIC 3.5, and 192.168.121.200 as the kong-gateway-proxy address.

Sunday, July 26, 2026 | 5 minutes Read

SAML in Kong through Keycloak

Kong’s official saml plugin requires an Enterprise license. After reviewing the open community and free-software alternatives, I could not find a direct, maintained SAML plugin compatible with Kong 3.x that would be responsible to recommend. This lab therefore uses a different, fully open architecture: Keycloak acts as the SAML Service Provider and identity broker, while Kong uses the open community or free-software kong-openid-connect plugin installed in the previous article. User authentication still performs a real SAML request and response. Keycloak validates the signed XML and returns an OpenID Connect Authorization Code to Kong.

Sunday, July 26, 2026 | 5 minutes Read

Session in Kong

The Session plugin lets an authenticated client reuse its identity through a cookie. It does not authenticate clients on its own and must work alongside another mechanism that validates the first request. This lab combines Session with Key Auth. The first request presents an API key, Kong creates a session, and later requests use only the cookie. We also configure an explicit anonymous branch to prevent requests without either credential from reaching the backend.

Sunday, July 26, 2026 | 7 minutes Read

LDAP Auth in Kong

LDAP Authentication lets Kong validate a username and password directly against a corporate directory. The backend does not receive those credentials and does not need to implement LDAP. This article explains how the authentication header is built, how Kong locates the user in the directory, and how to protect /ldap-auth through Kong Ingress Controller. This lab continues from Installing KIC. It reuses the kong Gateway, the echo Service, and the 192.168.121.200 address assigned by MetalLB to kong-gateway-proxy.

Sunday, July 26, 2026 | 5 minutes Read