Serverless Gateway reference

Serverless Gateways are lightweight API gateways with a fully hosted control plane in Konnect and automatically-provisioned data plane nodes. They are highly available, backed by a service-level agreement (SLA), and designed to handle lightweight production workloads.

Because you don’t need to manage any infrastructure, Serverless Gateways are a strong fit for startups, new projects, and teams that want to run low-to-moderate production traffic, as well as for development, testing, and experimentation.

You can manage your Serverless Gateway nodes under API Gateway in Konnect.

When you create a Serverless Gateway, Konnect creates a control plane that is hosted by Konnect. Then, a hosted data plane is provisioned automatically and configured to connect to the control plane.

  
flowchart TD
    A(Dev Portal • Observability • Catalog)
    B( Kong-managed Control Plane #40;Kong Gateway instance#41;)
    C( Data Plane #40;Kong Gateway instance#41;)

    subgraph id1 [Konnect]
    A --- B
    end

    B --Kong proxy 
    configuration---> id2

    subgraph id2 [Fully-managed cloud nodes]
    C
    end

    style id1 stroke-dasharray:3,rx:10,ry:10
    style id2 stroke-dasharray:3,rx:10,ry:10
  

To provision a Serverless Gateway, you need to create a serverless control plane and a hosted data plane.

Konnect UI

The easiest way to provision a Serverless Gateway is through the Konnect UI, where Konnect creates both a control plane and a data plane in one step.

1. In the Konnect sidebar, click API Gateway.
2. Click the New button, then select New API Gateway.
3. Select Serverless.
4. Give your Gateway a name and an optional description.
5. Click Create to save.

Konnect APIs

You can use the Konnect APIs to provision control planes and data planes programmatically.

Make sure that you have a Konnect token set in your environment.

curl -X POST "$KONNECT_CONTROL_PLANE_URL/v2/control-planes/" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Accept: application/json"\
     -H "Content-Type: application/json" \
     --json '{
       "name": "serverless-gateway-control-plane",
       "description": "A test control plane for Serverless Gateways.",
       "cluster_type": "CLUSTER_TYPE_SERVERLESS_V1",
       "cloud_gateway": true,
       "auth_type": "pinned_client_certs"
     }'

export CONTROL_PLANE_ID=YOUR-GENERATED-ID-HERE

curl -X PUT "https://us.api.konghq.com/v3/cloud-gateways/configurations" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Accept: application/json"\
     -H "Content-Type: application/json" \
     --json '{
       "control_plane_id": "'$CONTROL_PLANE_ID'",
       "control_plane_geo": "us",
       "dataplane_groups": [
         {
           "region": "us",
           "provider": "aws"
         }
       ],
       "kind": "serverless.v1"
     }'

curl -X POST "$KONNECT_CONTROL_PLANE_URL/v2/control-planes/" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Accept: application/json"\
     -H "Content-Type: application/json" \
     --json '{
       "name": "serverless-gateway-control-plane",
       "description": "A test control plane for Serverless Gateways.",
       "cluster_type": "CLUSTER_TYPE_SERVERLESS",
       "cloud_gateway": false,
       "auth_type": "pinned_client_certs"
     }'

export CONTROL_PLANE_ID=YOUR-GENERATED-ID-HERE

curl -X PUT "https://global.api.konghq.com/v3/cloud-gateways/configurations" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Accept: application/json"\
     -H "Content-Type: application/json" \
     --json '{
       "control_plane_id": "'$CONTROL_PLANE_ID'",
       "control_plane_geo": "us",
       "dataplane_groups": [
         {
           "region": "na"
         }
       ],
       "kind": "serverless.v0"
     }'

You can now proxy requests through your Serverless Gateway, and it will use the hosted data plane to process traffic.

Konnect integrates domain name management and configuration with Serverless Gateways.

Konnect configuration

1. In Konnect, navigate to API Gateway in the Konnect sidebar.
2. Click a control plane to open the Overview dashboard.
3. Click Connect.
4. In the Connect menu, save the URL from the Public Edge DNS field.
5. Navigate to Custom Domains in the sidebar.
6. Click New Custom Domain.

7. Enter your domain name.

   Save the value that appears under CNAME.

Domain registrar configuration

1. Log in to your domain registrar’s dashboard.
2. Navigate to the DNS settings section. This area might be labeled differently depending on your registrar.
3. Locate the option to add a new CNAME record and create the following record using the CNAME value from Konnect that you saved previously. For example, in AWS Route 53, it would look like this:

Once a Serverless Gateway custom DNS record has been validated, it will not be refreshed or re-validated. Remove and re-add the custom domain in Konnect to force a re-validation.

Serverless Gateways only support public networking. If your use case requires private connectivity, consider using Dedicated Cloud Gateways with AWS Transit Gateways.

To securely connect a Serverless Gateway to your backend, you can inject a shared secret into each request using the Request Transformer plugin.

1. Ensure the backend accepts a known token like an Authorization header.
2. Attach a new plugin to the control plane and Gateway Service that you want to secure:

curl -X POST "$KONNECT_CONTROL_PLANE_URL/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins" \
     --no-progress-meter --fail-with-body  \
     -H "accept: application/json"\
     -H "Content-Type: application/json"\
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "request-transformer",
       "config": {
         "add": {
           "headers": [
             "Authorization:Bearer '$SECRET_TOKEN_VALUE'"
           ]
         }
       }
     }'

Egress IPs

If you’re using Serverless Gateways V1 (US and EU regions only), you can use egress IPs to filter IP addresses for your upstream Serverless Gateway applications.

The Serverless V1 egress IPs are:

• 18.207.85.202
• 54.224.105.45
• 52.202.189.172
• 3.214.24.226
• 3.228.135.57

Serverless Gateways have the following limits:

• Request rate limit: Serverless Gateways support up to 100 requests per second (RPS) per gateway.
• Maximum request size: Incoming requests are limited to a maximum payload size of 10MB. For workloads that exceed these limits, consider using Dedicated Cloud Gateways for higher throughput and larger request sizes.