Kong AI Gateway 2.0 Unifies Security Across GKE, Cloud Run, and Vertex AI

·1 views

Kong has released AI Gateway 2.0, designed to enforce uniform authentication, observability, and cost governance across fragmented Google Cloud compute environments including GKE and Cloud Run. The platform addresses a growing challenge for enterprises that simultaneously run stateful microservices on Kubernetes and serverless APIs on Cloud Run alongside AI workloads. Unlike traditional API gateways built for deterministic request-response traffic, Kong AI Gateway 2.0 treats AI models, agents, and Model Context Protocol servers as first-class control plane entities. It introduces token-based rate limiting, semantic prompt inspection, and dynamic tool governance to handle non-linear, agentic traffic patterns. The gateway decouples configuration from the data plane, allowing runtime operations to scale independently across private networks without duplicating security stacks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

From Hookswitch to Grave

Article URL: https://computer.rip/2026-06-14-hookswitch-to-grave.html Comments URL: https://news.ycombinator.com/item?id=49559901 Points: 3 # Comments: 0

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How DNS Actually Works on Ubuntu 26.04: A Deep Dive into Two Layers

A developer conducted a detailed investigation into DNS resolution on a fresh Ubuntu 26.04 server, tracing a name lookup from application to answering server. DNS on Ubuntu operates in two distinct layers: the C library's name lookup, which checks /etc/hosts first via /etc/nsswitch.conf, and the systemd-resolved stub resolver listening on 127.0.0.53. Systemd-resolved acts as a local caching resolver that forwards queries to upstream DNS servers learned per network interface from DHCP or Netplan configuration. Tools like dig and nslookup bypass the first layer entirely, which explains why they can return different results than ping or curl. Key practical takeaways include using resolvectl to inspect upstream servers and query results, editing Netplan rather than resolv.conf for upstream changes, and understanding split DNS for per-domain routing used by tools like Tailscale's MagicDNS.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nginx add_header Duplicates Headers Instead of Overriding, Silently Breaking Security

A developer discovered a critical misconfiguration after deploying a baseline of security headers across nginx virtual hosts intended to protect apps that set none of their own. Within an hour, production responses showed duplicate and contradictory headers — for example, both X-Frame-Options: DENY from the app and SAMEORIGIN from the baseline appearing simultaneously. Browsers receiving conflicting directives for the same header treat it as absent entirely, meaning the stricter app-level setting was effectively nullified. The root cause was a misunderstanding of nginx's add_header directive, which always appends rather than replaces existing headers and cannot conditionally check upstream responses. The developer resolved the issue using nginx map directives on upstream header variables, since add_header offers no built-in conditional or override logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Finds Four Silent Bugs Sharing One Root Cause: Unverified Assertions

A software developer documented a day of debugging across four repositories on September 2, 2026, uncovering 22 commits that all traced back to the same underlying flaw: systems confidently reporting states that were never actually verified. Among the issues found were a compliance control marked green based on a redaction trait that was applied to no model, a kitchen display hiding paid orders, a dashboard showing a high success rate alongside visible failures, and a service worker serving outdated CSS. Most critically, password hashes were being written into an immutable audit log retained for a year, with no way to retract them — prompting their outright exclusion rather than masking. The developer concluded that generated evidence must be tested for reachability, and that silent wrong values are far more dangerous than thrown errors because they provide no signal that anything is wrong.

0 comments Read more at DEV Community