Kong Features
To use core kong features, set up service objects, route rules, and traffic plugins. These tools let your team direct requests, check client keys, and limit request rates. Teams often set up these components to manage incoming app traffic at the network edge. Still, teams often grant broad admin roles to developers during setup to speed up work. Broad permissions let users change routes or read secrets across the whole cluster. How core kong features work in practice The platform runs on a si
Linkerd Security Features + Kong Security Plugins: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To use core kong features, set up service objects, route rules, and traffic plugins. These tools let your team direct requests, check client keys, and limit request rates. Teams often set up these components to manage incoming app traffic at the network edge. Still, teams often grant broad admin roles to developers during setup to speed up work. Broad permissions let users change routes or read secrets across the whole cluster.
How core kong features work in practice
The platform runs on a simple model built around services, routes, consumers, and plugins. A service object represents your own backend API or micro app. A route rule tells the system how to match incoming requests and send them to a service. You can match traffic by host name, path, or request method.
Consumers represent the people or client apps that call your services. You attach plugins to services, routes, or consumers to run logic on traffic. Some plugins check API keys or tokens before letting a request pass. Other plugins count requests to enforce rate limits and stop traffic spikes. Logging plugins send request data to external log tools so teams can track errors. Teams can store this state in a database or run without a database using declarative files.
What native routing solves and where gaps remain
These edge tools solve the problem of managing north-south web traffic for public APIs. They give teams one place to set up TLS, block bad web requests, and route calls. Admin roles also help control which team members can edit routes in the control plane.
Still, edge routing rules only decide which client can reach an API endpoint. They do not govern what engineers or workloads do inside databases and servers during live sessions. Once a user or service passes the initial check, it holds full access to the backend role. Native web routing cannot inspect individual database queries or shell commands in flight. It also does not rewrite sensitive fields like emails, phone numbers, or card numbers in query results. If an engineer logs into the host to fix an issue, web plugins do not track those commands. Teams still face risks from broad internal permissions and shared database keys.
Linkerd Security Features + Kong Security Plugins: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Setting up safer workflows for your team
To reduce risk, teams should separate public API routing from internal system access. Keep edge plugins focused on client app traffic, rate limits, and basic token checks. Limit control plane admin roles to a small group of platform engineers. Store all service secrets in a dedicated secret tool rather than plain files.
For internal engineers who need to debug backend data or run server commands, avoid broad network roles. Move away from static keys and look for controls that inspect every action in flight. Applying rules at the query and command level keeps data safe during daily work.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between a service and a route?
A service points to the actual backend API or server that processes the work. A route defines the public path or host rules that send client traffic to that service.
Can you run the platform without a database?
Yes, you can run nodes in a mode that skips the database. In this mode, you load all services, routes, and plugins from a single state file.
Do API plugins protect against direct database queries by engineers?
No, API plugins only inspect HTTP and web traffic passing through the defined routes. They do not inspect direct database sessions or shell commands run by internal staff.