Core Responsibilities

# Kong declarative routing configuration
_format_version: "3.0"

services:
  - name: user-service
    url: http://user-service:8080
    routes:
      - name: users-route
        paths:
          - /api/v1/users
        methods:
          - GET
          - POST
        strip_path: true

  - name: order-service
    url: http://order-service:8080
    routes:
      - name: orders-route
        paths:
          - /api/v1/orders
        headers:
          X-Region:
            - us-east
            - us-west

upstream user_service {
    # Least connections — best for variable response times
    least_conn;

    server user-svc-1:8080 weight=3;
    server user-svc-2:8080 weight=2;
    server user-svc-3:8080 weight=1;

    # Health check — mark as down after 3 failures
    server user-svc-4:8080 max_fails=3 fail_timeout=30s;
}

server {
    location /api/users {
        proxy_pass http://user_service;
        proxy_next_upstream error timeout http_502 http_503;
        proxy_next_upstream_tries 2;
    }
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    # Certificate management
    ssl_certificate     /etc/ssl/certs/api.example.com.pem;
    ssl_certificate_key /etc/ssl/private/api.example.com.key;

    # Modern TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # OCSP stapling for faster handshakes
    ssl_stapling on;
    ssl_stapling_verify on;

    # Forward to backend as plain HTTP
    location / {
        proxy_pass http://backend_service;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}

# Envoy gRPC-JSON transcoding filter
http_filters:
  - name: envoy.filters.http.grpc_json_transcoder
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder
      proto_descriptor: "/etc/envoy/proto.pb"
      services:
        - user.UserService
      print_options:
        add_whitespace: true
        always_print_primitive_fields: true

# Client sends: POST /v1/users {"name": "Alice"}
# Gateway translates to: gRPC UserService.CreateUser(CreateUserRequest{name: "Alice"})
# Backend responds with protobuf, gateway translates back to JSON

plugins:
  - name: request-transformer
    config:
      add:
        headers:
          - "X-Request-ID:$(uuid)"
          - "X-Forwarded-Host:$(headers.host)"
      remove:
        headers:
          - Cookie
      rename:
        headers:
          - "Authorization:X-Original-Auth"

  - name: response-transformer
    config:
      remove:
        headers:
          - X-Powered-By
          - Server
          - X-Internal-Trace
      add:
        headers:
          - "X-Response-Time:$(latency)"
      remove:
        json:
          - internal_id
          - debug_info