Talk tech with tips and tutorials from builders at Kong and the Kong Community.
APIs are essential to modern applications, but managing access and security policies can be complex. Traditional access control mechanisms can fall short when flexible, scalable, and fine-grained control over who can access specific resources is needed. This is where OPA (Open Policy Agent) steps…
[](/blog/engineering/how-to-manage-your-api-policies-with-opa-open-policy-agent)
For the last couple of years, Retrieval-Augmented Generation (RAG) architectures have become a rising trend for AI-based applications. Generally speaking, RAG offers a solution to some of the limitations in traditional generative AI models, such as accuracy and hallucinations, allowing companies to…
[](/blog/engineering/rag-application-kong-ai-gateway-3-8)
Before we dive in, we want to remind our readers that the Konnect engineering team actively uses Kong products like Kong Gateway, Kong Mesh, and Insomnia. In this post, we'll showcase the power of Kong Gateway and two plugins — the JQ and Request Transformer Advanced Plugins — to govern and…
[](/blog/engineering/kong-gateway-transformer-plugins)
For the last 10+ years, Docker has been one of the leading technology tools for helping developers build, run, update, and manage containers. It is one of the most widely used containerization tools available, able to work with Linux, Microsoft Windows, Apple MacOS, and all of the leading cloud…
[](/blog/engineering/top-docker-desktop-extensions-for-developers)
Container technologies are always evolving — and we're not talking Tupperware here. Over the past years, service mesh has emerged as a crucial component for managing complex, distributed systems. As organizations increasingly adopt Kubernetes for orchestrating their containerized applications,…
[](/blog/engineering/using-service-mesh-in-kubernetes-enviroment)
Today, more organizations than ever before rely on web and mobile applications and partner integrations to help them automate and scale, making APIs essential to today’s software ecosystem. But because APIs are gateways to sensitive data, this also makes them an attractive target for hackers who…
[](/blog/engineering/api-security-risks-and-how-to-mitigate-them)
In the rapidly evolving world of microservices and cloud-native applications , service mesh has emerged as a critical tool for managing complex, distributed systems. As organizations increasingly adopt microservices architectures, they face new challenges in service-to-service communication,…
[](/blog/engineering/implementing-a-service-mesh)
The pace of the industry today is pressuring software developers to build, test, and release software more frequently than ever. To achieve this pace, teams have built two core processes into their workflow: Continuous Integration and Continuous Deployment. Continuous Integration and Continuous…
[](/blog/engineering/what-is-ci-cd)
The router component in the Kong Gateway is a crucial element for traffic handling, allowing the definition of specific matching rules to identify and process client requests. As a core component of the gateway, the router plays a vital role in ensuring the functionality, flexibility, security as…
[](/blog/engineering/rust-based-router-kong-gateway)
In a previous blog post , we discussed the prevalence of bearer tokens (or access tokens) to restrict access to protected resources, the challenges the sheer nature of bearer tokens present, and available mitigations. To recap, presenting a bearer token is proof enough of an authorization grant to…
[](/blog/engineering/demonstrating-proof-of-possession-dpop-preventing-illegal-access-of-apis)
In this article, we'll talk about our experience implementing a design system at Kong. We'll go over the reasons why we decided we needed one in the first place, where we started, and how we got to where we are today. We'll also cover the technology we used and how it has transformed software…
[](/blog/engineering/lessons-learned-implementing-a-design-system)
OAuth 2.0 is the current gold standard for secure delegated authorization. The reason is simple: OAuth puts control back in the hands of the users. It enables users to securely grant access to their resources without having to share passwords with third-party applications. Hence, it's one of the…
[](/blog/engineering/3-extensions-to-improve-security)
The JSON Web Token (JWT) is an open standard that allows information to be transferred securely between different parties. The token is digitally signed by using a private key (HMAC) or a public/private key (RSA) by building a JSON Web Signature (JWS). It guarantees that the JWT hasn’t been…
[](/blog/engineering/craft-and-sign-custom-jwt)
Two of the main tenets of Zero Trust are encryption between services and managing the connections each service is allowed to use. Achieving this generally falls to running a service mesh in a Kubernetes cluster. Refactoring applications to run properly in Kubernetes takes time and considerable…
[](/blog/engineering/zero-trust-on-vms-with-universal-mesh)
As organizations build more APIs, manual processes and frequent handoffs in the API development workflow can lead to a slower time to market, higher development costs, and poor-quality APIs. They can also result in APIs being poorly documented, causing poor API adoption and lower revenues. APIOps…
[](/blog/engineering/automating-api-delivery-with-apiops-and-kong)