Kong (software)

Kong (software)
Name	Kong
Title	Kong
Developer	Kong Inc.
Released	2015
Programming language	Lua, Go
Operating system	Cross-platform
License	Apache License 2.0

Kong (software) Kong is an open-source API gateway and service mesh platform designed to manage, secure, and extend APIs and microservices. Originally created to address scalability and governance needs for Netflix-style microservices and Amazon Web Services-hosted infrastructures, Kong evolved into a commercial product maintained by Kong Inc., serving enterprises such as Microsoft, Roche, Electronic Arts, Verizon, and Walmart.

Overview

Kong functions as a high-performance, extensible proxy that mediates traffic between clients and upstream services in modern distributed systems. It supports protocol routing, authentication, rate limiting, observability, and transformation for HTTP, HTTPS, and gRPC traffic, and integrates with container orchestration platforms such as Kubernetes and virtualization platforms such as Docker. The project is related to other gateway and mesh projects including Envoy (software), NGINX, Traefik, Istio, and Linkerd, and is positioned in stacks used by organizations like GitHub, Spotify, and Airbnb.

Architecture

Kong's architecture centers on a lightweight, high-performance proxy layer and a control plane that manages configuration and plugins. The dataplane runs as a reverse proxy built on OpenResty and NGINX with Lua modules, later supplemented by a Go-based hybrid mode for performance and extensibility. The control plane persists state in datastores such as PostgreSQL and Apache Cassandra, and exposes admin APIs and declarative configuration for integration with CI/CD tools like Jenkins and GitLab CI/CD. For service mesh use cases, Kong can interoperate with sidecar proxies and control planes used in Istio or run its own mesh control via Kong Gateway and Kuma-related components. Clustered deployments coordinate via leader election and health checks, often integrating with orchestration projects like Helm and Terraform.

Features

Kong provides feature areas important to cloud-native operators: request routing and load balancing, TLS termination and certificate management, authentication and authorization via OAuth2 and JWT, rate limiting and request throttling, logging and metrics export to systems such as Prometheus and Grafana, and tracing integrations with Jaeger and Zipkin. Extensibility is delivered through a plugin model supporting both on-demand community and enterprise plugins for observability, security, and transformation workflows. Kong also offers a developer portal and catalog features for API lifecycle management, aligning with practices promoted by OpenAPI and Swagger specification tooling.

Deployment and Operations

Kong is deployed in multiple modes: traditional gateway, database-backed control plane, and DB-less declarative mode for immutable infrastructure patterns. Operators use container images with orchestration via Kubernetes and Helm charts, or VM-based installations on platforms such as Amazon EC2, Google Compute Engine, and Microsoft Azure. CI/CD pipelines integrate Kong configuration through GitOps tools like Flux and Argo CD, enabling automated promotion of routing and policy changes. Monitoring and alerting commonly use stacks incorporating Prometheus, Grafana, Alertmanager, and log aggregation with ELK Stack components such as Elasticsearch and Kibana.

Integrations and Plugins

Kong's plugin ecosystem includes integrations for identity providers like Okta and Auth0, observability sinks for Datadog and New Relic, and backends such as LDAP and Active Directory. Community and enterprise plugins offer transformations, request/response modification, caching, and custom authentication schemes, and developers can author plugins in Lua or via the Go plugin server. Kong also integrates with API management and developer experience tooling like Apigee, Mulesoft, Postman, and registry formats like OpenAPI, enabling governance and developer onboarding workflows used by organizations such as Salesforce and Siemens.

Security and Performance

Security features include TLS termination, mutual TLS (mTLS) support for service-to-service authentication, OAuth2 and JWT validation, IP-based access control, bot detection, and integration with Web Application Firewalls and WAF services. Kong supports performance optimizations like caching, connection pooling, circuit breaking, and health checks, leveraging high-performance components such as NGINX and LuaJIT in OpenResty or the Go runtime in hybrid deployments. For observability of performance, Kong emits metrics and traces consumable by Prometheus, Jaeger, and enterprise APM tools to help teams at Netflix, Dropbox, and Adobe evaluate latency, throughput, and error budgets.

History and Development

Kong was founded by engineers who previously worked on large-scale API infrastructures and launched in 2015 under the stewardship of Mashape, later renamed Kong Inc. The project matured through community contributions and commercial offerings including Kong Enterprise and Kong Gateway, competing and collaborating with projects such as Envoy (software), Istio, and NGINX Plus. Kong's roadmap has included support for service mesh capabilities through projects like Kuma and investments in a Go-based data plane to address high-throughput environments. The project has been adopted by corporations and open-source communities and continues to develop via contributions from developers and vendors participating in ecosystems around Cloud Native Computing Foundation-adjacent tooling and cloud providers.

Category:API management