DevOps · DOP-09

API Gateway with Kong

API Gateway with Kong is a hands-on course in designing and running an API gateway with Kong Gateway, from routing and load balancing to key, JWT and OIDC authentication, rate limiting, caching, config as code with decK, observability and the Gateway API on Kubernetes. It suits backend developers, DevOps teams and architects who expose APIs to other systems or partners.

Updated 20 Oct 2026

From 7,650 THB / person 8,500 −10% excl. VAT 7% · group rates available

Corporate training quote Join the waiting list

PDFDownload the course outline

Duration18 hours · 3 days
FormatOnsite / live online
Next roundOn request
CertificateIncluded

Course overview

As organisations expose more APIs to internal systems, mobile apps and external partners, each service tends to re-implement authentication, rate limiting, logging and data transformation on its own. Standards drift apart and security becomes hard to control. There is now a new challenge as well: routing calls to LLMs and AI agents through a single point to keep token costs and data exposure under control. A well-designed API gateway answers all of these problems.

This course explains the role of an API gateway, compares the main products on the market and then works hands-on with the open source edition of Kong Gateway: services, routes and load balancing, authentication with keys, JWT and OIDC through Keycloak, rate limiting, transformation and caching, and declarative configuration with decK. It continues with observability through Prometheus and OpenTelemetry, running the gateway on Kubernetes with the Gateway API standard, and an overview of AI gateways, all built up on one project, the MetroLink Partner API Platform. (3 days, 6 hours per day, 18 hours in total, Intermediate level.)

What you’ll gain

Understand the role, usage patterns and trade-offs of an API gateway in a microservices architecture
Compare and choose a suitable API gateway, such as Kong, Apache APISIX, Traefik or a cloud gateway
Install Kong Gateway in DB-less and database-backed modes and define services, routes and upstreams
Protect APIs with key authentication, JWT, ACLs and an OIDC identity provider
Control traffic, transform data and cache responses at the gateway without changing the backend
Manage configuration declaratively with decK and bring it into a GitOps workflow
Monitor APIs fully with metrics, logs and distributed traces
Run the gateway on Kubernetes with the Gateway API and understand AI gateways for LLM traffic

Who this course is for

Backend developers who expose APIs to other systems or external partners
DevOps, platform and system engineers who run the infrastructure behind APIs
Software architects who choose and standardise the organisation's API gateway
Security teams who want to understand API access control at the gateway

Prerequisites

A working knowledge of HTTP, REST APIs, headers, status codes and JSON
Experience building or using web APIs in at least one language
Command-line skills and Docker experience up to running containers and Docker Compose
A laptop with 16 GB RAM or more that can run Docker Desktop or Docker Engine, with permission to install software

Curriculum

Course Details

This course focuses on API gateway principles that apply to any product, and puts them into practice with the open source edition of Kong Gateway. It runs for 3 days, 6 hours per day (18 hours in total, 09:00-16:00), as a continuous workshop on the MetroLink Partner API Platform, a fictional transport company that uses only sample data. Intermediate level. Every lab runs on the learner's own laptop with Docker and kind, with no licence required.

Enterprise-only features, such as the OpenID Connect plugin and the full Kong AI Gateway, are covered as an overview and demonstration. The course differs from Enterprise GenAI Gateway and Private AI Platform, which focuses on gateways for GenAI workloads, and pairs well with Observability with Prometheus and Grafana and Kubernetes (K8s) Orchestration. Service mesh, custom Lua plugin development and developer portals are out of scope. Learners take home the lab guide, docker-compose files, decK configuration files and Gateway API manifests.

Day 1 API Gateway Concepts and Kong Fundamentals

Section 1: The Role of an API Gateway in Modern Architecture

The cross-cutting concerns a gateway handles, such as authentication, rate limiting and logging
Edge gateway, Backend for Frontend (BFF) and internal gateway patterns
How reverse proxies, ingress controllers, API gateways and service meshes differ
What does not belong in a gateway, such as business logic, and the risk of it becoming a bottleneck
Workshop: sketch the MetroLink API architecture and split duties between the gateway and the services

Section 2: Choosing the Right API Gateway

Kong Gateway, Apache APISIX, Traefik, Envoy Gateway and the cloud API gateways of AWS, Azure and Google
The Kubernetes Gateway API is a standard, not a product, and needs an implementation
Selection criteria: licence, plugins, performance, deployment model and cost
The differences between Kong's open source and Enterprise editions to know before deciding
Workshop: build a comparison table to choose a gateway for a given organisation

Section 3: Lab: Kong Gateway Architecture and Installation

Built on NGINX and OpenResty: proxy ports, the Admin API and Kong Manager
DB-less mode versus PostgreSQL mode, and hybrid mode with a control plane and data planes
The plugin system, plugin scopes (global, service, route, consumer) and execution order
Lab: install Kong Gateway with Docker Compose in both DB-less and PostgreSQL modes

Section 4: Lab: Services and Routes

Define services and routes by path, host, method and header
Strip path, preserve host and how routes are matched when several rules apply
Manage everything through the Admin API and test with curl, Bruno or Postman
Lab: run the mock Route, Schedule and Booking services with Docker Compose and expose them through the gateway

Section 5: Lab: Upstreams, Load Balancing and Health Checks

Upstreams and targets for spreading load across several instances
Round robin, least connections and consistent hashing algorithms
Active and passive health checks, timeouts and retries
Workshop: add an upstream with two targets, stop one and watch traffic fail over automatically

Day 2 Security, Traffic Control and Config as Code

Section 6: Lab: Consumers, Key Auth and ACLs

Consumers and credentials to represent each API client
Key authentication and basic authentication for internal systems
ACL groups for partner access by Basic and Premium plans
Keep credentials away from the backend and pass the caller's identity in headers instead
Lab: protect internal APIs with key auth and restrict access by plan with ACLs

Section 7: Lab: JWT and OIDC with Keycloak

The OAuth 2.0 and OpenID Connect concepts you need before wiring them to a gateway
Set up a Keycloak realm and client to issue tokens to partners
The JWT plugin: verifying signatures, expiry and claims
The Enterprise OIDC plugin compared with JWT validation in the open source edition
Lab: a partner obtains a token from Keycloak and calls the API through the gateway

Section 8: Network Protection and Rate Limiting

IP restriction, CORS and request size limiting
Managing TLS and certificates at the gateway
Time-window rate limiting, with counters stored locally or in Redis
Different quotas per plan, and request termination for maintenance windows
Lab: set per-plan rate limits backed by Redis and load test until the quota is exceeded

Section 9: Lab: Transformation and Caching

Request and response transformers to add, remove or change headers and bodies
Correlation IDs for tracing requests across systems
Proxy caching and deciding what to cache and for how long
The idea of canary releases by splitting traffic at the gateway
Lab: cache the timetable API and measure before and after

Section 10: Lab: Declarative Configuration with decK

decK's dump, diff, validate and sync commands
Keeping configuration in Git and separating values per environment
A GitOps approach: changing the gateway through reviewed merge requests
Lab: export the whole MetroLink configuration to decK files, then sync and roll back changes

Day 3 Observability, Kubernetes and AI Gateways

Section 11: Lab: API Gateway Observability

The Prometheus plugin and Grafana dashboards for latency, error rate and throughput
Shipping logs with the File Log and HTTP Log plugins
The OpenTelemetry plugin and distributed traces from gateway to backend in Jaeger
Lab: add metrics, logs and traces to MetroLink and find the cause of a slow request

Section 12: Kubernetes and the Gateway API

The Kubernetes basics you need: pods, deployments, services and namespaces
Gateway API v1.6: GatewayClass, Gateway and HTTPRoute
Separating the infrastructure owner's role from development teams that own their routes
The Gateway API compared with classic Ingress, and how to migrate

Section 13: Lab: Kong on Kubernetes

Create a local cluster with kind
Install the Kong Ingress Controller with Helm
Route with HTTPRoute and attach Kong plugins to Kubernetes resources
Lab: move the MetroLink APIs to Kubernetes with the same authentication and rate limits

Section 14: AI Gateways for Controlling LLM Traffic

Why LLM calls should go through one point: token cost, data protection and switching providers
Kong AI Gateway capabilities such as AI Proxy, token rate limiting, semantic caching and prompt guards
Emerging controls for AI agents and MCP tool calls through a gateway
Lab: route requests to a local LLM in Ollama using the AI plugins of Apache APISIX

Section 15: Production Readiness and Master Workshop

High availability, separating control and data planes, and version upgrades
Load testing with k6 and reading the dashboards to tune the gateway
A checklist before opening APIs to partners in production
Master Workshop: bring every capability together on MetroLink, test it under load and present the team's architecture

Schedule & training options

For individuals — public rounds

No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770

Join the waiting list Ask about rounds

For organisations — in-house / private

Tailor the content to your team’s tools and projects
Your dates, at your office or live online
Quotation with tax ID for procurement

Corporate training quote

Instructors

Samit KoyomFounder & CEO, IT Genius Engineering

Frequently asked questions

How does this course differ from Enterprise GenAI Gateway and Private AI Platform?

Enterprise GenAI Gateway and Private AI Platform focuses on gateways and platforms built specifically for GenAI workloads. This course covers API gateways for an organisation's general APIs: routing, authentication, rate limiting, caching, config as code, observability and Kubernetes, with AI gateways as a closing overview topic. To go further with monitoring or Kubernetes, continue with Observability with Prometheus and Grafana and Kubernetes (K8s) Orchestration.

Do I need a Kong licence?

No. All labs use the open source edition of Kong Gateway from the official Docker image, which needs no licence. Enterprise-only features, such as the OpenID Connect plugin and the full Kong AI Gateway, are explained and demonstrated by the instructor so you can judge whether your organisation needs the Enterprise edition.

My organisation already uses a different gateway. Is this course still useful?

Yes. The course focuses on principles that apply to any gateway, such as splitting duties between gateway and services, authentication, rate limiting, config as code and observability. It also compares Kong, Apache APISIX, Traefik, Envoy Gateway and cloud API gateways so you can map the ideas onto the product you already run.

I have never used Kubernetes. Can I follow Day 3?

Yes. Day 3 covers the Kubernetes basics the labs need, including pods, deployments, services and namespaces, and uses kind to create a cluster on your own laptop, so no existing cluster is required. You should, however, be comfortable with Docker and Docker Compose as stated in the prerequisites.

How should I prepare my laptop?

You use your own laptop with at least 16 GB RAM and about 30 GB of free disk space, with Docker Desktop (WSL2 on Windows) or Docker Engine, Git, VS Code and an API client such as Bruno or Postman installed. kubectl, Helm and kind are installed with guidance in class. You need permission to install software and pull Docker images over your network.

Do I need a paid LLM account for the AI gateway lab?

No. The lab uses a small model running locally in Ollama together with the AI plugins of Apache APISIX. If you want to try a cloud LLM provider as well, you use your own account and API key, which may incur usage charges.

Articles are published in Thai.