As a cloud service provider, observability is a critical subject as it's strongly related to the availability of the services running on the platform. We need to understand everything that is happening on our platform to troubleshoot errors as fast as possible and improve performance issues. A year ago, while the platform was still in private beta, we faced a tough reliability issue: users were facing random 500 errors when accessing their applications.

We are happy to announce the release of Kong Mesh 1.9 and Kuma 1.8! This release is packed with features and improvements such as observability for builtin Gateway, a complete rewrite of the CNI and projected service account tokens support. In order to take advantage of the latest and greatest in service mesh, we strongly suggest upgrading to Kong Mesh 1.9.

Today, the Envoy community has introduced Envoy Gateway, a new project to better support Kubernetes deployments via the new Kubernetes Gateway API, which is the next generation Ingress specification in Kubernetes world. Kong has been deeply invested in the success of Envoy since we started developing Kuma in 2019 – now used in Kong Mesh (built on top of Kuma).

Recently, I was fortunate to have an insightful conversation with Matt Klein, Lyft software engineer and creator of Envoy, the popular open-source edge and service proxy for cloud-native applications. Envoy was the third project to graduate from the Cloud Native Computing Foundation (CNCF), following Kubernetes and Prometheus. Before Lyft, Matt held positions at Microsoft, Amazon and Twitter, and served on the oversight committee and board of the CNCF.

It’s not uncommon for organizations to have to deploy solutions across (or among) multiple security domains. Here, we use the term “security domain” to refer to a segregated network environment, like a restricted internal network or a DMZ. This post will explore some design considerations when deploying Kong Mesh (and Kuma, the CNCF-hosted open source project upon which Kong Mesh is built) in environments with multiple security domains.