North-south vs east-west
- North-south — clients/Internet → platform (API gateway, WAF, CDN)
- East-west — service ↔ service inside VPC/K8s (Service Mesh topic)
Different threat models, auth, and rate limits.
API gateway responsibilities
| Concern | Gateway | Origin service |
|---|---|---|
| TLS termination | ✓ | optional mTLS behind |
| JWT/OAuth validation | ✓ | fine-grained authZ |
| Rate limiting / WAF | ✓ | business quotas |
| Routing / versioning | ✓ | — |
| Request logging / trace ID inject | ✓ | span continuation |
| Business logic | ✗ | ✓ |
Products: Kong, Apigee, AWS API Gateway, Envoy as gateway, Cloudflare.
Gateway vs load balancer
L7 LB (ALB, nginx) — distribute traffic, TLS, basic routing. API Gateway — adds auth plugins, API keys, request transformation, developer portal, usage plans.
Many teams: Cloudflare/WAF → ALB → gateway → services.
Auth at the edge
- Validate JWT signature + expiry at gateway
- Forward claims as headers (
X-User-Id) — sign internal headers or use mTLS to prevent spoofing - Fine-grained RBAC stays in domain service
Staff trap: gateway as sole authorization brain — can't express resource-level permissions.
Rate limiting tiers
- Global — protect platform (DDoS)
- Per API key / tenant — product limits
- Per endpoint — expensive queries throttled harder
Return 429 + Retry-After; coordinate with Communication idempotency for retries.
API versioning at gateway
Route /v1/* → v1 upstream cluster; /v2/* → v2. Sunset headers on deprecated routes.
Cross-reference: Communication → REST for versioning strategies; Networking for TLS and CDN; Observability → Distributed Tracing for traceparent injection.
Further Reading
Hands-On Tasks (Optional)
Architecture drills and whiteboard exercises. Assumes Communication & Data Transfer and Distributed Systems fundamentals.
- Map concerns to gateway vs service15m
List: JWT validation, per-tenant rate limit, request logging, business validation, DB access. Place each at edge gateway, mesh, or origin service.