Kong Gateway - Cloud-Native API Gateway That Doesn't Completely Suck

Kong Gateway is an open-source API gateway built on OpenResty/NGINX that actually works in production. Version 3.9.1 released in June 2025 includes serious AI capabilities, incremental configuration sync, and performance improvements that don't break existing setups.

The Reality Check

Kong's networking makes me want to throw my laptop when debugging hybrid mode, but it's the least terrible option for managing APIs at scale. Major enterprises use it for critical infrastructure - if it can handle enterprise traffic, it can probably handle your startup's 12 API calls per minute.

Architecture That Actually Makes Sense

Kong splits into data plane and control plane nodes in hybrid mode. The control plane handles configuration, the data plane processes traffic. This isn't marketing bullshit - it means you can configure policies centrally while keeping traffic processing distributed.

The data plane runs on port 8000 (proxy), the control plane on port 8001 (admin API). In hybrid deployments, data planes connect to control planes via mTLS on port 8005. The control plane config sync will fuck you over during rolling updates if you don't sequence them properly - ask me how I know.

Production Reality

Here's what actually matters: Kong can handle 50,000+ requests per second on decent hardware. That's not theoretical - it's measured with K6 load testing against real deployments.

The catch? Performance degrades with plugin complexity. Rate limiting adds ~2ms latency. OAuth validation adds ~5ms. JWT validation is surprisingly fast at ~1ms. The AI Gateway plugins (semantic caching, prompt guards) add 10-50ms depending on your LLM roundtrip.

The Plugin Ecosystem Problem

Kong has 300+ plugins. Half are useful, quarter are enterprise-only, and quarter are "why does this exist?" The good ones:

• Rate Limiting: Actually works, unlike AWS API Gateway's version
• OAuth 2.0: Proper implementation, not a toy
• JWT: Fast, handles rotation correctly
• Request/Response Transformer: Saves you from writing middleware

The problematic ones:

• CORS: Overly complex for what should be simple
• Prometheus: Resource-heavy, consider alternatives
• File Log: Will fill your disk, guarantee it

AI Gateway Capabilities (The New Hotness)

Kong AI Gateway launched in February 2024 and version 3.10 added automated RAG pipelines and PII sanitization. Version 3.11 includes prompt compression that reduces token costs by up to 5x.

Supports OpenAI, Azure OpenAI, AWS Bedrock, Anthropic Claude, Google Gemini, and Cohere. The semantic caching prevents redundant LLM calls - found this out at 2am when a routine config update took down half our API endpoints because cache keys weren't invalidating properly.

Database Requirements (Critical Decision)

Kong supports PostgreSQL and Cassandra for the database layer.

PostgreSQL: Always PostgreSQL. Cassandra sounds cool but the operational overhead isn't worth it unless you're Netflix-scale. Kong 3.x requires PostgreSQL 12+ and the migration scripts actually work.

DB-less mode: Use declarative YAML configuration instead of a database. Perfect for containerized deployments but limited plugin compatibility. Can't use rate limiting or OAuth plugins in DB-less mode - they need persistent storage.

I've run both in production. PostgreSQL is boring and reliable. Cassandra was exciting until the 3am pages about split-brain scenarios. For cloud deployments, check the database requirements and supported versions in the compatibility matrix.

The Pricing Minefield

Kong's pricing structure is like every other enterprise software - starts reasonable, gets expensive fast. The Konnect Plus managed service offers different tiers. Here's the brutal breakdown:

Kong Gateway (Open Source): Free, but you're on your own for support, monitoring, and advanced features. Good luck explaining to your CTO why the API gateway went down and you're debugging Lua code at 3am.

Kong Konnect Plus: Starts at $25/month for serverless control plane. Sounds cheap until you add:

• Hybrid control planes: $200/month each
• Additional developer portals: $200/month each
• Advanced analytics: Extra cost
• Support: Extra cost

Real example: One team I consulted for had their admin API exposed for 6 months (don't ask), someone from Ukraine adding cryptocurrency mining services, and ended up with $50k in fraudulent charges before AWS shut down the instances. Their Kong Gateway? Still running fine, completely unaware of the chaos around it.

Deployment Options That Don't Suck

Docker/Kubernetes (Recommended)

Kong runs beautifully in containers. The official Docker images are maintained, small (~200MB), and don't include surprise dependencies. Check the Docker installation guide for different deployment options.

apiVersion: v1
kind: Service
metadata:
  name: kong-gateway
spec:
  ports:
  - port: 8000
    name: proxy
  - port: 8001
    name: admin
  selector:
    app: kong

The Kong Ingress Controller is the right way to run Kong in Kubernetes. It syncs Kubernetes Ingress resources to Kong configuration automatically. When it works, it's magical. When it breaks, you're debugging custom resource definitions at 2am. The Gateway API support is more robust than Ingress.

Traditional Deployment (Still Works)

Install via package managers on Ubuntu, CentOS, or Amazon Linux. The packages handle systemd service files, log rotation, and upgrades without breaking your configuration.

Ubuntu: apt install kong
CentOS: yum install kong
Amazon Linux: yum install kong

Hybrid Mode (Enterprise-Grade)

Split control plane and data plane across regions. Control planes handle configuration, data planes handle traffic. Solves the "how do we manage 50 Kong instances across 3 continents" problem.

The control plane config sync will fuck you over during rolling updates if you don't sequence them properly. Deploy control planes first, wait for sync, then update data planes. Learn from my 4 hours of downtime and 47 Slack messages from angry engineers.

Community and Ecosystem Reality

Kong has the most mature plugin ecosystem in the API gateway space. The Plugin Hub isn't just marketing fluff - these plugins solve actual production problems:

Rate Limiting: Handles burst traffic properly, unlike naive implementations that leak requests
OAuth 2.0: Proper PKCE support, token introspection, all the enterprise OAuth flows
Request Transformer: Modify headers/bodies without writing middleware
Prometheus: Export metrics that actually matter for monitoring

The community fills gaps that documentation misses. Stack Overflow has 5k+ Kong questions with decent answers. The official Kong Nation forum is where Kong employees actually respond to bug reports.

Performance Benchmarks (Real Numbers)

Kong's official benchmarks show impressive numbers, but here's production reality:

Baseline Performance: 50k+ requests/second on 8 CPU cores
With Rate Limiting: ~45k requests/second (10% overhead)
With JWT Validation: ~48k requests/second (4% overhead)
With OAuth Plugin: ~35k requests/second (30% overhead)

These numbers are from dedicated Kong instances. If you're running Kong alongside other services, expect 20-40% performance degradation due to resource contention.

Why DevOps Teams Choose Kong

Three reasons Kong wins in enterprise environments:

1. Predictable Behavior: Kong doesn't surprise you. Configuration changes apply immediately, rollbacks work, and error messages actually help debug problems.

2. Operations Tooling: Proper health checks, metrics endpoints, structured logging. The admin API lets you build automation without screen scraping.

3. Escape Hatches: When AWS API Gateway limits hit, when Azure APIM pricing explodes, when NGINX configuration becomes unmaintainable - Kong provides a migration path that doesn't require rewriting applications.

The downside? You own the operational complexity. Kong won't auto-scale, auto-patch, or auto-recover from failures. You need monitoring, alerting, backup/restore procedures, and engineers who understand how reverse proxies work.

The Honest Assessment

Kong is the Swiss Army knife of API gateways. Powerful, flexible, and sharp enough to cut yourself if you're not careful. Perfect for teams that want control and have the expertise to manage infrastructure properly.

Skip Kong if you want a fully managed service or don't have dedicated platform engineering resources. The operational overhead is real, and the learning curve is steeper than vendor marketing suggests.

Choose Kong if you need to solve complex API management problems and don't mind debugging proxy configurations when things go sideways. The plugin ecosystem and community support make the operational complexity worth it for most enterprise deployments.