Cloud-Native API Gateway Practitioner (Course #cloud-native-gateway)

Programme every line is something you do

7 modules · 21 topics · in course-flow order

1. Module 1

   Three roles, three resources

   Objective. Design the role separation Gateway API assumes and produce the RBAC split that lets service teams own their own routes.

   • Map GatewayClass, Gateway and HTTPRoute onto the 3 personas the specification names: infrastructure provider, cluster operator, application developer
   • Split RBAC so a service team merges a route without touching listeners, reducing the 9-day review to a single team approval
   • Model listener, hostname and route attachment rules, and prove which namespace may attach to which listener
2. Module 2

   Routes that survive a rename

   Objective. Construct a route set whose matching, rewriting and traffic-splitting behaviour is specified rather than inherited from a controller default.

   • Express path, header and method matching precisely, and resolve precedence between 4 overlapping rules
   • Implement weighted traffic splitting for a canary at 5% and prove the split with request-level evidence
   • Move filters — rewrite, redirect, request-header mutation — out of annotations and into declared route filters
3. Module 3

   Kong end to end

   Objective. Deploy the reference route set on Kong and record which behaviours require Kong-specific extension.

   • Install the controller and bind a GatewayClass, then reconcile the full route set with zero manual edits
   • Attach 3 policies — authentication, rate limiting, request transformation — and record which are portable and which are Kong-specific
   • Read the plugin execution order explicitly; priority changes between releases silently reorder a policy chain
4. Module 4

   Traefik end to end

   Objective. Deploy the identical route set on Traefik and produce the divergence report between the two data planes.

   • Reconcile the same route set on a second data plane and count the resources that needed no change
   • Diff behaviour across the 2 implementations for matching precedence, header handling and error responses
   • Record every divergence as either a conformance gap or an implementation-specific extension, with the evidence for each
5. Module 5

   Identity at the edge

   Objective. Implement OAuth 2.0 and OIDC verification at the gateway and prove the identity the backend actually receives.

   • Validate JWTs at the edge — issuer, audience, expiry, key rotation — and reject on all 4 without reaching the backend
   • Terminate and re-originate TLS for a mutual-TLS partner, keeping the client identity readable downstream
   • Diff the request before and after the gateway to prove no authorization header is dropped or remapped in transit
6. Module 6

   Limits that hold

   Objective. Configure rate limiting whose enforcement is measured under partition rather than assumed from configuration.

   • Choose a counting strategy deliberately: local, cluster and shared-store counting differ by a factor of N nodes
   • Cut the counter store for 60 seconds under load and record what the limiter actually enforced during the outage
   • Compare the data-plane implementations of the same limit on Envoy and Kong, and document the accuracy each achieves
7. Module 7

   Reconcile, observe, prove

   Objective. Operate the estate through GitOps and demonstrate its behaviour under a load profile matching production peak.

   • Reconcile declared against running configuration on every merge and fail the build on any drift
   • Emit RED metrics and distributed traces from the data plane, with a trace sampled on at least 1% of requests
   • Load-test to the 4-region peak profile and record p99 latency and error rate against a 400 ms target

References & Official Documentation every claim above has a source

Module 1

• Kubernetes Gateway APIMuleSoft Docs

Module 2

• HTTPRouteMuleSoft Docs

Module 3

• Kong plugin execution and priorityMuleSoft Docs

Module 4

• Traefik Proxy documentationMuleSoft Docs

Module 5

• OpenID Connect Core 1.0Specification
• RFC 7519 — JSON Web Token (JWT)Specification

Module 6

• Envoy global rate limitingMuleSoft Docs
• Rate Limiting Advanced pluginMuleSoft Docs

More in Architecture