Serverless Gateway

Serverless gateways are lightweight API gateways. Their Control Plane is hosted by Konnect and Data Plane nodes are automatically provisioned. Serverless gateways are ideal for developers who want to test or experiment in a pre-production environment.

You can manage your serverless gateway nodes in Gateway Manager.

When you create a serverless gateway, Konnect creates a Control Plane that is hosted by Konnect. Then, a hosted Data Plane is provisioned automatically and configured to connect to the Control Plane.

  
flowchart TD
    A(Dev Portal • Gateway Manager • Advanced Analytics • Service Catalog)
    B( Kong-managed Control Plane #40;Kong Gateway instance#41;)
    C( Data Plane #40;Kong Gateway instance#41;)

    subgraph id1 [Konnect]
    A --- B
    end

    B --Kong proxy 
    configuration---> id2

    subgraph id2 [Fully-managed cloud nodes]
    C
    end

    style id1 stroke-dasharray:3,rx:10,ry:10
    style id2 stroke-dasharray:3,rx:10,ry:10
  

Provisioning a serverless gateway includes creating the serverless Control Plane and hosted Data Plane.

1. Create a serverless gateway Control Plane by issuing a POST request to the Control Plane API.

   curl -X POST "$KONNECT_CONTROL_PLANE_URL/v2/control-planes/$CONTROL_PLANE_ID/" \
        -H "Accept: application/json"\
        -H "Content-Type: application/json"\
        -H "Authorization: Bearer $KONNECT_TOKEN" \
        --json '{
          "name": "serverless-gateway-control-plane",
          "description": "A test Control Plane for Serverless Gateways.",
          "cluster_type": "CLUSTER_TYPE_SERVERLESS",
          "cloud_gateway": false,
          "auth_type": "pinned_client_certs"
        }'
   

2. Create a hosted Data Plane by issuing a PUT request to the Cloud Gateways API:

   curl -X PUT "$KONNECT_CONTROL_PLANE_URL/v2/cloud-gateways/configurations" \
        -H "Accept: application/json"\
        -H "Content-Type: application/json"\
        -H "Authorization: Bearer $KONNECT_TOKEN" \
        --json '{
          "control_plane_id": "'$CONTROL_PLANE_ID'",
          "control_plane_geo": "us",
          "dataplane_groups": [
            {
              "region": "na"
            }
          ],
          "kind": "serverless.v0"
        }'
   

Konnect integrates domain name management and configuration with Serverless Gateways.

Konnect configuration

1. Open Gateway Manager, choose a Control Plane to open the Overview dashboard, then click Connect.

   The Connect menu will open and display the URL for the Public Edge DNS. Save this URL.

2. Select Custom Domains from the side navigation, then New Custom Domain, and enter your domain name.

   Save the value that appears under CNAME.

Domain registrar configuration

1. Log in to your domain registrar’s dashboard.
2. Navigate to the DNS settings section. This area might be labeled differently depending on your registrar.
3. Locate the option to add a new CNAME record and create the following record using the CNAME value from Konnect that you saved previously. For example, in AWS Route 53, it would look like this:

Once a Serverless Gateway custom DNS record has been validated, it will not be refreshed or re-validated. Remove and re-add the custom domain in Konnect to force a re-validation.

Serverless gateways only support public networking. If your use case requires private connectivity, consider using Dedicated Cloud Gateways with AWS Transit Gateways.

To securely connect a serverless gateway to your backend, you can inject a shared secret into each request using the Request Transformer plugin.

1. Ensure the backend accepts a known token like an Authorization header.
2. Attach a new plugin to the Control Plane and Gateway Service that you want to secure:

curl -X POST "$KONNECT_CONTROL_PLANE_URL/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins" \
     -H "accept: application/json"\
     -H "Content-Type: application/json"\
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "request-transformer",
       "config": {
         "add": {
           "headers": [
             "Authorization:Bearer '$SECRET_TOKEN_VALUE'"
           ]
         }
       }
     }'