Implementations & Operations

# Kong DB-less declarative configuration
_format_version: "3.0"

services:
  - name: user-service
    url: http://user-service:8080
    connect_timeout: 5000
    read_timeout: 30000
    retries: 2
    routes:
      - name: users-route
        paths:
          - /api/v1/users
        methods:
          - GET
          - POST
          - PUT
        strip_path: true
        plugins:
          - name: rate-limiting
            config:
              minute: 100
              policy: redis
              redis_host: redis
          - name: jwt
            config:
              claims_to_verify:
                - exp

consumers:
  - username: mobile-app
    plugins:
      - name: rate-limiting
        config:
          minute: 5000  # Higher limit for mobile app

// AWS CDK — HTTP API with Lambda integration
{
  "Type": "AWS::ApiGatewayV2::Api",
  "Properties": {
    "Name": "order-api",
    "ProtocolType": "HTTP",
    "CorsConfiguration": {
      "AllowOrigins": ["https://app.example.com"],
      "AllowMethods": ["GET", "POST", "PUT", "DELETE"],
      "AllowHeaders": ["Authorization", "Content-Type"],
      "MaxAge": 86400
    }
  }
}

// Route with JWT authorizer
{
  "Type": "AWS::ApiGatewayV2::Route",
  "Properties": {
    "ApiId": {"Ref": "OrderApi"},
    "RouteKey": "POST /orders",
    "AuthorizationType": "JWT",
    "AuthorizerId": {"Ref": "CognitoAuthorizer"},
    "Target": {"Fn::Join": ["/", ["integrations", {"Ref": "OrderLambdaIntegration"}]]}
  }
}

# Envoy bootstrap — connects to xDS control plane for dynamic config
admin:
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 9901

dynamic_resources:
  lds_config:  # Listener Discovery Service
    api_config_source:
      api_type: GRPC
      grpc_services:
        - envoy_grpc:
            cluster_name: xds-cluster
  cds_config:  # Cluster Discovery Service
    api_config_source:
      api_type: GRPC
      grpc_services:
        - envoy_grpc:
            cluster_name: xds-cluster

static_resources:
  clusters:
    - name: xds-cluster
      connect_timeout: 5s
      type: STRICT_DNS
      load_assignment:
        cluster_name: xds-cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: control-plane
                      port_value: 18000

# Traefik auto-discovers routes from Kubernetes Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares:
      default-rate-limit@kubernetescrd,
      default-auth@kubernetescrd
spec:
  tls:
    - hosts:
        - api.example.com
      secretName: api-tls  # Auto-managed by cert-manager
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /api/users
            pathType: Prefix
            backend:
              service:
                name: user-service
                port:
                  number: 8080
          - path: /api/orders
            pathType: Prefix
            backend:
              service:
                name: order-service
                port:
                  number: 8080
# Traefik automatically picks this up — no restart needed

# Kubernetes deployment for HA gateway
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
spec:
  replicas: 3  # Minimum 3 for HA
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0  # Zero downtime during updates
  template:
    spec:
      # Spread across availability zones
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
      # Anti-affinity — don't schedule on same node
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: api-gateway
              topologyKey: kubernetes.io/hostname
      containers:
        - name: gateway
          resources:
            requests:
              cpu: "2"
              memory: "4Gi"
            limits:
              cpu: "4"
              memory: "8Gi"
          readinessProbe:
            httpGet:
              path: /health
              port: 8001
            initialDelaySeconds: 5
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "15"]  # Drain connections

# GitOps workflow for gateway configuration
# 1. Developer pushes config change to Git
# 2. CI validates config (syntax, schema, dry-run)
# 3. CD applies to staging gateway
# 4. Automated tests verify staging
# 5. CD applies to production gateway (rolling)

# CI validation step
validate:
  script:
    # Kong deck validates declarative config
    - deck validate --state kong.yaml
    # Dry-run against staging
    - deck diff --state kong.yaml --kong-addr http://staging-gateway:8001

# CD deployment step
deploy:
  script:
    # Apply config with zero downtime
    - deck sync --state kong.yaml --kong-addr http://gateway:8001
    # Or for Kubernetes:
    - kubectl apply -f gateway-config.yaml
    # Rolling update handles the rest

# Graceful shutdown sequence for gateway instance:

# 1. Remove from load balancer (stop receiving new connections)
#    - Kubernetes: pod enters Terminating state
#    - NLB: health check fails → deregisters target

# 2. Wait for in-flight requests to complete
#    - preStop hook: sleep 15 (allow LB to deregister)
#    - Gateway drains: finish active requests (up to 30s)

# 3. Close idle connections
#    - Send Connection: close on keep-alive connections

# 4. Terminate process
#    - SIGTERM → graceful shutdown
#    - SIGKILL after grace period (30s) if still running

# Key: the sleep in preStop gives the load balancer time to
# stop sending new requests before the gateway starts draining.