Kong

Kong is a cloud-native API gateway built on Nginx that sits between clients and microservices to handle authentication, rate limiting, logging, transformation, and routing. As requests flow through Kong, plugins apply policies like API key validation, JWT verification, request/response transformation, caching, and traffic control. Used by organizations from startups to Fortune 500 companies to centralize API management and security without modifying application code.

Best for: Platform and DevOps teams managing microservices architectures or public APIs who need centralized request handling, authentication, and rate limiting. Particularly valuable when multiple backend services need consistent security policies, or when migrating from monoliths to microservices where Kong provides routing and service discovery. Teams running Kubernetes appreciate Kong's native integration.

Common Questions

What does an API gateway do?
An API gateway acts as a reverse proxy that sits in front of your APIs to handle cross-cutting concerns: authentication (API keys, OAuth, JWT), rate limiting to prevent abuse, request/response transformation, load balancing across backend instances, logging and metrics, caching frequently accessed data, and routing requests to correct services. This keeps these responsibilities out of application code.

How does Kong compare to AWS API Gateway?
Kong is open-source, cloud-agnostic, and self-hosted (or use Kong Konnect managed service), giving you full control and no vendor lock-in. AWS API Gateway is fully managed but tightly coupled to AWS ecosystem. Kong offers more plugin extensibility (50+ official plugins, custom Lua plugins) while AWS API Gateway integrates deeply with other AWS services. Kong works across on-premise, multi-cloud, and hybrid environments.

Is Kong free?
Yes, Kong Gateway (open-source) is completely free under Apache 2.0 license with core features including routing, authentication, rate limiting, logging, and load balancing. Kong Gateway Enterprise adds enterprise plugins, RBAC, developer portal, and support starting at $3,500/year per gateway instance. Kong Konnect is the fully managed SaaS offering with custom pricing.

What plugins does Kong support?
Kong has 50+ official plugins including authentication (API key, JWT, OAuth 2.0, Basic Auth), security (rate limiting, ACL, IP restriction, bot detection), traffic control (request/response transformation, correlation ID, proxy caching), analytics (Prometheus, Datadog, StatsD), and serverless (AWS Lambda, Azure Functions invocation). Custom plugins can be written in Lua or using PDK (Plugin Development Kit).

Pricing & Plans

Kong Gateway (OSS):

• Free and open-source under Apache 2.0 license
• Unlimited throughput, deployments, services
• Community support via forums and GitHub

Kong Gateway Enterprise:

• From $3,500/instance/year (negotiable based on volume)
• Adds enterprise plugins, RBAC, Dev Portal, Manager UI, support

Kong Konnect (SaaS):

• From $500-$2,000+/month depending on traffic volume
• Fully managed control plane, multi-cloud deployment
• Custom pricing for enterprise features

Limitations

• Operational complexity (OSS): Self-hosting requires PostgreSQL or Cassandra database, load balancer setup, high-availability configuration, and ongoing maintenance. Not trivial for small teams.
• Performance overhead: Every request passes through Kong, adding latency (typically 1-10ms depending on plugins). Under-provisioned Kong instances become bottlenecks.
• Lua for custom plugins: Extending Kong with custom logic requires Lua programming knowledge, which is less common than Python, JavaScript, or Go among developers.

Getting Started

For Docker (quickest):

1. Run Kong with PostgreSQL: docker-compose up using official Kong compose file
2. Access Kong Admin API at http://localhost:8001
3. Create a service: curl -i -X POST http://localhost:8001/services --data name=example --data url=https://httpbin.org
4. Create a route: curl -i -X POST http://localhost:8001/services/example/routes --data 'paths[]=/api'
5. Test routing: curl http://localhost:8000/api/get
6. Add plugins via Admin API or Kong Manager UI

For Kubernetes:

1. Install Kong Ingress Controller via Helm: helm install kong kong/kong
2. Define Kubernetes services and ingresses
3. Kong automatically configures routing based on ingress rules

For Production:
Use Kong Konnect managed service or deploy Kong on VMs/containers with PostgreSQL cluster, monitoring, and multi-region setup.