API Gateways and API Management

API gateways (Kong, Envoy/Envoy Gateway, NGINX, AWS API Gateway, Apigee, Azure API Management, Tyk) centralize cross-cutting concerns: TLS, authentication (JWT validation, API keys, OAuth introspection), rate limiting and quotas, routing and canary releases, request size limits, CORS, caching, and analytics. API management platforms add developer portals, key provisioning, plans and monetization. Keep business logic out of gateways; use the Kubernetes Gateway API for portable configuration.

Gateway vs service responsibilities

# Kubernetes Gateway API: route /v1/orders to the orders service with a canary
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: orders }
spec:
  parentRefs: [{ name: public-gateway }]
  rules:
    - matches: [{ path: { type: PathPrefix, value: /v1/orders } }]
      backendRefs:
        - { name: orders-v1, port: 8080, weight: 90 }
        - { name: orders-v1-canary, port: 8080, weight: 10 }

Common pitfalls

• Business rules in gateway plugins.
• Gateway as the only authorization layer.
• Single gateway cluster without redundancy.

Key points

• Centralize cross-cutting concerns
• Authorization stays in services
• Gateway API for portable routing

Further reading: Kubernetes Gateway API