Kong Gateway：一个 API 网关怎么处理每一次调用Kong Gateway: how an API gateway handles each call

2026-10-07api-gateway nginx plugins proxy ai-gateway

Kong Gateway overview: In: an admin describes the APIs, then apps and AI clients call them through Kong. 1 Set up: the Admin API on port 8001, Kong Manager on port 8002, or a declarative config file describe services, routes, plugins and upstreams. 2 Keep the config: in Postgres, or with no database from a config file held in memory, or in hybrid mode where a control plane pushes it to data planes. 3 Handle each call: apps call port 8000 or 8443; Kong matches a route, runs the plugins for it, such as auth, rate limits and logging, and picks a healthy target. 4 Reach the backend: your services, LLM providers through the AI plugins, and logs and metrics tools.

Kong 是基于 Nginx 的开源 API 网关。应用调用 Kong，Kong 把每次调用转给对的后端。途中可以认出调用方、限流、记日志。

一次调用。 Kong 匹配一条路由，运行它的插件，挑一个后端，再把回复送回去。匹配不到路由就回 404。

One call through Kong: In: an app sends an HTTP call to Kong. 1 Arrive: the proxy listens on port 8000 for HTTP and 8443 for HTTPS; for HTTPS Kong picks the TLS certificate by the server name (SNI); global plugins run their rewrite step before routing. TCP and UDP ports are off by default. 2 Match a route: the router checks host, path, method and more, finds the Route and the Service behind it; with no match Kong answers 404, no Route matched. 3 Run plugins: the access step runs the plugins for this route, service or consumer, such as auth, limits and transforms; a plugin may answer early and stop the call. 4 Proxy and return: the balancer picks a target, the upstream answers, response plugins change headers and body, and log plugins run after the reply. — 一次调用：到达、匹配路由、运行插件、转发并返回

插件干大部分活。自带 45 个：认证、限流、改写、日志和指标。

What the bundled plugins do: In: a call that matched a route. Kong bundles 45 plugins, grouped here by job, not by run order: within each phase the higher priority runs first, and priorities interleave across the groups. The 6 AI plugins have their own figure. Who is calling, 9 plugins: keys and tokens (key-auth, jwt, oauth2), passwords and signatures (basic-auth, ldap-auth, hmac-auth, standard-webhooks), sessions and groups (session, acl). Guard traffic, 9 plugins: limits (rate-limiting, response-ratelimiting, request-size-limiting), who may come in (ip-restriction, bot-detection, cors), and cache, stop or certificates (proxy-cache, request-termination, acme). Change or forward, 9 plugins: rewrite the call (request-transformer, response-transformer, redirect), other backends (aws-lambda, azure-functions, grpc-gateway, grpc-web), and your own code (pre-function runs first, post-function last). Watch and log, 12 plugins: metrics (prometheus, statsd, datadog), traces (opentelemetry, zipkin, correlation-id) and logs (http-log, file-log, tcp-log, udp-log, syslog, loggly); most of them run in the log phase, after the reply. — 内置插件：认人、把关、改写转发、观测

插件规则。 加载插件不等于开启。开启后，最具体的设置生效，优先级高的先跑。也可以自己写：用 Lua，或通过插件服务器用 Go、JavaScript。

Which plugin runs, and in what order: In: a plugin, bundled or your own. 1 Write or pick: 45 plugins come bundled, for auth, limits, logs and more; you can write your own in Lua with the Plugin Development Kit, or in Go or JavaScript through plugin servers set with the pluginserver_names setting. Wasm filters need the setting wasm = on, which is off by default. 2 Load: the plugins setting, bundled by default, only loads the code; a plugin entity turns it on; Kong will not start if a configured plugin is not loaded. 3 Scope: a plugin can be set globally or for a route, a service, a consumer or a mix of them; for each call the most specific of 8 levels wins, route plus service plus consumer first and global last. 4 Order: plugins run by PRIORITY, higher first, in each phase from rewrite and access to header_filter, body_filter and log; for example correlation-id 100001, key-auth 1250, rate-limiting 910 and syslog 4. pre-function runs Lua snippets near the start and post-function near the end. — 插件规则：加载、范围、顺序

选后端。 upstream 把调用分给多个目标，默认轮询。健康检查要自己开。调用失败会重试，默认最多 5 次。

Picking a backend: In: a call has matched a route, so Kong knows its service. 1 Where it goes: the service names a host. If that host is the name of an upstream, Kong balances the call across the upstream's targets, each an address and port with a weight, 100 by default; otherwise it goes to that one host. 2 Algorithm: round-robin by default, or consistent-hashing on the consumer, IP, a header, a cookie, the path, a query argument or a URI capture, or least-connections, or latency. 3 Health checks: active probing sends test requests to targets; it is off by default. Passive checks watch real responses as a circuit breaker; also off by default. Unhealthy targets get no calls. 4 Retries and timeouts: on a failure Kong reports it to the health checker and tries again, up to the service's retries, 5 by default; connect, write and read timeouts are 60 seconds by default. — 选后端：upstream、算法、健康检查、重试

配置经 Admin API、Kong Manager 或文件写入。存在 Postgres 里，或不用数据库，放在内存里（DB-less）。

Where the config lives: In: an admin changes routes, plugins or upstreams. 1 Change it: the Admin API listens on 127.0.0.1 port 8001, or 8444 with TLS, and should stay with admins; Kong Manager is a web UI on port 8002; a declarative config file is used with no database. 2 What it describes: services and routes say where calls go, consumers and plugins say who calls and what runs, upstreams and targets list backend addresses; also certificates, SNIs, vaults and keys. 3 Store it, one of two options picked with the database setting: Postgres, the default, where the Admin API edits each entity; or DB-less, database = off, where the config file is loaded into LMDB, the Admin API cannot create, update or delete single entities, and POST /config replaces the whole config. 4 Spread to workers: each node keeps two memory caches of 128 MB each, nodes on Postgres poll for changes every 5 seconds, and every 5 seconds each worker rebuilds its router and plugin list if needed. — 配置放在哪里：修改、内容、存储、分发到 worker

混合模式（设置项 role）把活分开。控制面管数据库，把整份配置推给数据面，数据面处理流量。

Hybrid mode: In: an admin changes the config on the control plane. Hybrid mode is a setting: role, which is traditional by default. 1 Control plane, role = control_plane: it needs the Admin API and a database, and listens for data planes on cluster port 8005. 2 Package the config: it exports the whole config with a hash, fits it to each data plane's version (same major version, data plane minor version not newer), and compresses it with gzip, at most 16 MB by default. 3 Data planes, as many as you run, role = data_plane: each one receives the config over a WebSocket secured with mutual TLS, using a shared certificate by default or certificates from a CA (pki); runs with database = off and loads the config into LMDB, Kong's local config store; proxies calls on ports 8000 and 8443; and pings the control plane every 30 seconds with its config hash. A data plane with no cached config yet can start from a declarative config file. — 混合模式：控制面打包整份配置，推给不带数据库的数据面

AI 插件让 Kong 接在 LLM 前面。AI Proxy 用一种调用形状，翻译给 9 家提供方。token 日志默认关闭。

Kong in front of LLMs: In: an app sends a chat call to a Kong route. 1 The app calls a route: a chat call (llm/v1/chat), a completions call (llm/v1/completions), or preserve, which is passed on without translation. The same call shape works for every provider. 2 Shape the request, in priority order: AI Request Transformer asks an LLM to rewrite the body, AI Prompt Template fills a named template's placeholders, AI Prompt Decorator adds chat messages before or after, and AI Prompt Guard checks allow and deny patterns. 3 AI Proxy translates the call into the provider's format, adds the provider key as a header or parameter, and sends it to one of 9 providers: OpenAI, Azure, Anthropic, Cohere, Mistral, Llama 2, Gemini, Bedrock and Hugging Face. 4 Answer back: the reply is translated back into the same call shape, AI Response Transformer can ask an LLM to rewrite it, and token statistics go to the log plugins only when log_statistics is on; prompts and replies are logged only when log_payloads is on. Both are off by default. — Kong 接在 LLM 前面：整理提示、翻译、返回

运行。 kong 命令负责准备、启动、重载和摘流一个节点。8007 端口的 Status API 报告健康状态和指标。

Running Kong: In: an operator runs Kong with the kong command. 1 Prepare: kong check validates a config file, kong migrations bootstrap, up and finish set up or update the Postgres schema, and kong hybrid gen_cert makes the certificate pair for hybrid mode. 2 Inside a node, after kong start: Nginx runs worker processes, auto by default; on data planes an extra worker handles config, on by default; values in the config can be vault references such as {vault://env/...}, and env is the one bundled vault. 3 Watch it: the Status API on port 8007, local only by default; /status/ready, which says whether the router and plugins are built; Prometheus metrics with its plugin, and tracing, which is off by default. Anonymous usage reports to Kong are on by default. 4 Day to day: kong reload starts new workers with the changed config, kong drain makes /status/ready return 503, and kong quit lets requests finish before shutting down, while kong stop sends a plain SIGTERM. — 运行 Kong：准备、节点内部、监看、日常命令

Kong is an open-source API gateway built on Nginx. Apps call Kong, and Kong passes each call on to the right backend. On the way it can check who is calling, limit traffic and log the call.

One call. Kong matches a route, runs the plugins for it, picks a backend and sends the answer back. No matching route means a 404.

Plugins do most of the work. 45 come bundled: auth, traffic limits, rewrites, logs and metrics.

Plugin rules. Loading a plugin doesn't turn it on. Turned on, the most specific setting wins, and higher priority runs first. You can write your own in Lua, or in Go or JavaScript through a plugin server.

Picking a backend. An upstream spreads calls over several targets. Round-robin is the default. Health checks are off until you set them. A failed call is retried, up to 5 times by default.

Config goes in through the Admin API, Kong Manager or a file. It lives in Postgres, or in memory with no database (DB-less).

Hybrid mode (a role setting) splits the work. A control plane holds the database and pushes the whole config to data planes, which serve the traffic.

AI plugins put Kong in front of LLMs. AI Proxy speaks one call shape and translates it for 9 providers. Token logging is off by default.

Running it. The kong command prepares, starts, reloads and drains a node. The Status API on port 8007 reports health and metrics.

来源Source: github.com

← 全部架构← All architectures