This presentation, delivered by Dan Abberuan, Director of Solutions Architecture at WSO2, introduces the critical need for gRPC API management within Kubernetes-native environments. It highlights common challenges in managing gRPC APIs, such as security, traffic governance, policy enforcement, observability, and versioning, which are often embedded within applications leading to tight coupling.
WSO2's solution is a Kubernetes Gateway, built on Envoy, designed to decouple these management concerns from gRPC applications. This gateway integrates with Kubernetes Gateway specifications, offering a scalable, eco-friendly deployment with features like automatic failover and load balancing. The presentation demonstrates several key functionalities: deploying gRPC APIs (via REST API and Custom Resource Definitions), configuring custom authentication, implementing rate limiting policies, enabling header modification, and adding custom interceptors for request/response mediation. The speaker also discusses successful adoption by large banking customers and future plans for a UI-driven control plane.
Summarizing gRPC API Management with Kubernetes Native API Management
0:00:02 Introduction to WSO2 & API Management Necessity: Dan Abberuan, Director of Solutions Architecture at WSO2, introduces the session on gRPC API management. WSO2, an open-source company with 20 years in the industry, specializes in API management, integrations, and identity solutions, being a pioneer in the API management space for 18 years. He emphasizes that API management is crucial for securing and exposing digital applications, enabling control and observability, and addressing common problems like managing B2B point-to-point connections.
0:01:41 The Problem: Decoupling Policies from gRPC Applications: Despite gRPC's performance benefits for inter-application communication, developers face challenges in enforcing policies (security, access control, traffic governance, operational policies, observability, versioning) without embedding them directly into their applications. The core requirement is to decouple these policies for better design and manageability.
0:02:43 WSO2's API Management Solution & Architecture: WSO2 offers both open-source and SaaS (Choreo) API management solutions. Their architecture distinguishes between a control plane (for security, lifecycle, governance, design, monetization, AI capabilities) and a data plane (various gateways). The presentation focuses on their Kubernetes Native Gateway, which supports gRPC, alongside immutable and universal gateways, and API federation capabilities.
0:07:03 WSO2 Kubernetes Gateway: The Solution Deep Dive: The WSO2 Kubernetes Gateway is built on Envoy and leverages Kubernetes Gateway specifications (like HTTPRoute) using adapters. This design promotes a Kubernetes eco-friendly deployment, ensuring scalability, automatic failover, and load balancing. It has been proven in production for handling high throughput in WSO2's internal cloud solutions.
0:09:57 Demo 1: Deploying gRPC APIs (REST API Method): The speaker demonstrates how to deploy a gRPC API using the REST API method. This involves defining the gRPC backend service, generating an API configuration from a Protobuff, adding backend service details (including potential circuit breaker logic), and deploying it to the Kubernetes Gateway. The gateway automatically enables security (JWT token) upon deployment, which is then verified by invoking the API using gRPC curl.
0:13:09 Demo 2: Deploying gRPC APIs (Custom Resource Definition Method): For developers preferring YAML-based configurations, gRPC APIs can be deployed using Custom Resource Definitions (CRDs). The process involves generating CRDs from Protobuff files and then applying desired policies directly within these definitions before deployment and invocation.
0:15:03 Demo 3 & 4: Authentication Configuration & Disablement: The system allows configuring different authentication types by defining them in CRDs and applying them to specific APIs. A demonstration shows applying an authentication policy, generating a token, and successfully invoking the API. Conversely, authentication can be disabled for certain APIs (e.g., for internal communication), and an attempt to invoke such an API without a token is shown to fail as expected.
0:16:38 Demo 5: Configuring Rate Limiting: This demonstration illustrates how to enforce rate limiting policies on gRPC APIs. By creating a YAML file that defines a rate limit (e.g., two requests per second) and applying it to a specific API, the gateway can actively reject excess requests, returning policy-enforced headers.
0:19:13 Demo 6: Enabling Header Modification: The gateway supports modifying headers for gRPC calls. A use case is presented where an incoming Authorization header is expected to be transformed into a Test header by policy. The demo shows an invocation failing with the original header and succeeding after the header is modified as per the defined policy.
0:20:47 Demo 7: Implementing Interceptors (Mediation): Custom interceptors can be enabled to mediate gRPC invocations (requests or responses). A Java interceptor is demonstrated, which adds a customized header to the API's response, showcasing the ability to enforce bespoke policies or add functionality within the request/response flow.
0:22:50 Q&A and Conclusion: The speaker addresses a question about real-world customer usage, confirming that large-scale banking customers in the APEC region are adopting the Kubernetes Gateway for its high scalability and alignment with their organizational shift to Kubernetes. WSO2 is also integrating this gateway into its internal cloud SaaS products. A future roadmap includes developing a UI-driven control plane for managing these features, as the current version is primarily command-line friendly.