api-gateway-design

To centralize authentication and rate limiting without modifying service code, enforce edge policies at the north-south API gateway boundary. This offloads cross-cutting concerns like JWT validation and per-tenant traffic control from individual microservices.

An API gateway handles north-south traffic and edge policy enforcement, while a service mesh manages east-west communication between internal microservices. Separating these concerns prevents the anti-pattern of smearing cross-cutting policies across your services.

To configure a Kong API gateway using GitOps, use declarative configuration tools like Kong Ingress Controller CRDs or decK. This enables version-controlled management of gateway routing and policies for your microservices infrastructure.

Yes, you can run a DB-less API gateway in a Kubernetes cluster. This architecture supports declarative GitOps-managed infrastructure by storing configuration directly in memory or as declarative manifests, eliminating the need for a gateway database.

To handle TLS termination and JWT validation at the cluster boundary, deploy a north-south API gateway. It centralizes edge security by processing incoming traffic before routing it to the internal microservices.

You should not use an API gateway for internal east-west microservices traffic routing. API gateways are designed for north-south edge policy enforcement, and using them for internal mesh concerns creates unnecessary latency and configuration complexity.