Kong High Availability Deployments via InterSystems API Manager

The purpose of this repo is to provide some concrete docker-compose.yml examples to help you experiment with different Kong deployment topologies.
This is not meant to teach you how Kong/IAM works, rather to help you understand how to deploy a Highly Available IAM once you have basic understanding of IAM. To learn how IAM works complete the pre-requisites.

Pre-Requisites:

• You should make sure to first complete Kong EE “Zero to Hero” training repo.
• Review Installing IAM 3.10
• Make sure you have a valid IAM license.
• You will need to have an IRIS/HSHC installation running that IAM can connect to.

IAM Deployment Topologies

IAM (essentially Kong Gateway) has 3 deployment topologies that allow for HA:

1. Kong Traditional Mode: Multiple Node Clusters

To run this, in the Traditional folder:
Make sure to set your environment variable IRIS_PASSWORD and review the YAML to make sure it points at your correct ports and hosts to get the IAM license.

docker compose up -d

Access the Kong Managers at http://localhost:8002 and http://localhost:8012.
Note that configurations set on one Manager are synced to the other as they share the same database.
Create some services and routes and test it out at exposed ports 8000 and 8010.

2. Hybrid Mode

To run this, in the Hybrid folder:
Make sure to set your environment variable IRIS_PASSWORD and review the YAML to make sure it points at your correct ports and hosts to get the IAM license.

Note that for the first time we have introduced a certificate and key. For the sake of simplicity I will try to avoid them in these examples and write about how to properly set up secure communication in an upcoming InterSystems Developer Community article. That being said, Hybrid Mode requires that the CP and DP communicate via mTLS hence it will be necessary here.

Create a /Certificates folder in the CP directory that will be referenced in the volumes section of the YAML and in this directory run the following (assuming you are on powershell with OpenSSL 1.1.1+) to create the certificate and key:

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -sha256 -days 825 `
  -keyout admin.key -out admin.crt `
  -subj "/CN=kong_clustering" `
  -addext "subjectAltName=DNS:kong_clustering"

Make sure to copy and paste the certificates directory to also appear in the DP directory.

Once that is done you can go ahead and first for the CP and then for the DP:

docker compose up -d

You can now go and create some services and routes at the Kong Manager on http://localhost:8002 and test API requests out at exposed ports 8000 and 8100.

3. DB-less Mode

To run this, in the DB-less folder:
Make sure to set your environment variable IRIS_PASSWORD and review the YAML to make sure it points at your correct ports and hosts to get the IAM license.

docker compose up -d

Test from a REST Client such as Postman sending:

GET http://localhost:8000/somepath/ or
GET http://localhost:8010/somepath/

with the proper Authorization IRIS/HSHC expects.