
LSEG's Automated Pipeline for Secure Kong API Gateway Images
In this session from API Summit 2024, the LSEG Kong SME team shares how they automated Kong API Gateway image creation. The process uses a GitLab pipeline to start with Debian base OS images, apply security hardening, and scan for vulnerabilities using BlackDuck. The result: secure, production-ready images that are published to the internal artifact repository and made available for LSEG project teams to consume.
Building a strong API foundation at LSEG
The London Stock Exchange Group (LSEG) is a leading global financial markets infrastructure and data provider. To support its internal developer and engineering teams across a range of business units, LSEG adopted Kong to manage and scale its API infrastructure.
A dedicated Kong SME team was formed, led by product owner Kaja and solution architect Sureshankar. Together with three other engineers, the team supports automation, deployment, and customization of Kong across LSEG’s internal environments.
When scale meets complexity
In early 2022, LSEG was deploying Kong images manually across customer environments. This process was time-consuming, inconsistent, and lacked visibility and standardization across teams. As adoption of Kong increased within the organization, the need for a streamlined, automated approach to building, securing, and distributing Kong images became critical.
The team also faced growing demands from internal customers for hardened, customizable Kong and Kong Ingress Controller (KIC) images, as well as improved onboarding, documentation, and support for various deployment environments (Azure, AWS, EKS, Anthos, and hybrid setups).
From manual to automated
To address these challenges, the LSEG Kong SME team developed a fully automated CI/CD pipeline using GitLab to build and publish customized Kong Distributed Images (KDI) and Kong Ingress Controller images.
The team began by downloading enterprise Kong images from Kong HQ and layered them with hardened base OS images (primarily Debian). Vulnerability scanning was integrated using Black Duck to ensure secure image delivery. Each image was tested in a local dev environment to ensure it was production-ready before release.
Images were then published to LSEG’s internal JFrog Artifactory repository and notifications were sent out to internal consumers alerting them to the new versions. A self-service portal—KDI Portal—was launched to serve as a central resource hub, offering onboarding instructions, plugin deployment patterns (such as Helm chart configurations), usage guides, and best practices.
Customers could further tailor their deployments by overriding Dockerfiles or adding their own plugins, with the SME team available for support as needed. The process also accommodated new customer onboarding and version migrations, with continued support offered across environments. LSEG’s team expanded their automation journey by testing and validating Kong Konnect, enabling SSO integration and dev portal access for select internal use cases. By early 2024, additional enhancements were underway to refine Konnect and developer portal capabilities. To track performance and adoption, the team encouraged all users to integrate with Datadog for detailed usage metrics.
A pipeline that delivers
Since the launch of the automated pipeline in 2022, LSEG has dramatically improved the speed, security, and consistency of Kong image delivery. Highlights include:
Accelerated Delivery: Internal customers now receive hardened, validated Kong images automatically, reducing manual effort and deployment time.
Standardized Onboarding: A self-service portal and onboarding process has streamlined adoption across new internal teams.
Improved Security: Vulnerability scanning and image validation have increased confidence in the production readiness of Kong images.
Wider Adoption: Multiple internal customers across Azure, AWS EKS, and Anthos now rely on the Kong SME team’s automation pipeline, with several new customers onboarded in 2024.
Innovation in Progress: Ongoing enhancements to Kong Konnect and Dev Portal functionality are underway, expanding the potential for centralized management and observability.
Through its investment in Kong automation, LSEG has established a scalable, secure, and flexible foundation for API management across its enterprise, supporting diverse use cases and cloud environments with confidence.