API Gateway & Service Mesh

# template.yaml - API Gateway HTTP API with Lambda

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  # HTTP API (cheaper than REST API)
  ApiGateway:
    Type: AWS::Serverless::HttpApi
    Properties:
      CorsConfiguration:
        AllowOrigins:
          - "*"
        AllowMethods:
          - GET
          - POST
          - PUT
          - DELETE
        AllowHeaders:
          - "*"
      Auth:
        Authorizers:
          JwtAuthorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              Audience:
                - your-api-audience
              Issuer: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx

  # Lambda function
  ApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./
      Handler: app.main.handler
      Runtime: python3.11
      Events:
        GetUsers:
          Type: HttpApi
          Properties:
            ApiId: !Ref ApiGateway
            Path: /users
            Method: GET
        CreateUser:
          Type: HttpApi
          Properties:
            ApiId: !Ref ApiGateway
            Path: /users
            Method: POST
            Auth:
              Authorizer: JwtAuthorizer  # Require JWT for POST

Outputs:
  ApiUrl:
    Description: API Gateway URL
    Value: !Sub "https://${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com/"

# Request mapping template - Transform query params to JSON body
{
  "user_id": "$input.params('userId')",
  "filter": "$input.params('filter')",
  "limit": #if($input.params('limit')) $input.params('limit') #else 10 #end
}

# Response mapping template - Extract nested data
#set($data = $input.path('$.data'))
{
  "items": [
    #foreach($item in $data.items)
    {
      "id": "$item.id",
      "name": "$item.name",
      "created": "$item.timestamp"
    }#if($foreach.hasNext),#end
    #end
  ],
  "total": $data.total
}

# Define usage tiers
UsagePlan:
  Type: AWS::ApiGateway::UsagePlan
  Properties:
    UsagePlanName: BasicTier
    Throttle:
      RateLimit: 100    # 100 requests/second
      BurstLimit: 200   # 200 concurrent
    Quota:
      Limit: 10000      # 10k requests per month
      Period: MONTH
    ApiStages:
      - ApiId: !Ref RestApi
        Stage: prod

# docker-compose.yml - Kong + PostgreSQL

services:
  kong-database:
    image: postgres:15
    environment:
      POSTGRES_USER: kong
      POSTGRES_DB: kong
      POSTGRES_PASSWORD: kong
    volumes:
      - kong-data:/var/lib/postgresql/data

  kong-migration:
    image: kong:3.8
    command: kong migrations bootstrap
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_PASSWORD: kong
    depends_on:
      - kong-database

  kong:
    image: kong:3.8
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_PASSWORD: kong
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_ADMIN_LISTEN: 0.0.0.0:8001
    ports:
      - "8000:8000"   # Proxy (HTTP)
      - "8443:8443"   # Proxy (HTTPS)
      - "8001:8001"   # Admin API
    depends_on:
      - kong-database
      - kong-migration

volumes:
  kong-data:

# Start: docker-compose up -d
# Admin API: http://localhost:8001
# Proxy: http://localhost:8000

# 1. Create a Service (upstream backend)
curl -i -X POST http://localhost:8001/services \
  --data name=users-api \
  --data url='http://users-service:8000'

# 2. Create a Route (how clients access it)
curl -i -X POST http://localhost:8001/services/users-api/routes \
  --data 'paths[]=/users' \
  --data 'methods[]=GET' \
  --data 'methods[]=POST'

# 3. Add Rate Limiting plugin
curl -i -X POST http://localhost:8001/services/users-api/plugins \
  --data name=rate-limiting \
  --data config.minute=100 \
  --data config.policy=local

# 4. Add JWT Authentication
curl -i -X POST http://localhost:8001/services/users-api/plugins \
  --data name=jwt

# 5. Add Request Transformer (add header)
curl -i -X POST http://localhost:8001/services/users-api/plugins \
  --data name=request-transformer \
  --data config.add.headers=X-Service:users-api

# Test the route
curl http://localhost:8000/users
# Kong routes this to http://users-service:8000/users
# Applies rate limiting, JWT validation, header transformation

<!-- Spike Arrest Policy - Smooth traffic spikes -->
<SpikeArrest name="SpikeArrest">
  <Rate>100ps</Rate>  <!-- 100 per second, smoothed -->
</SpikeArrest>

<!-- Verify API Key Policy -->
<VerifyAPIKey name="VerifyAPIKey">
  <APIKey ref="request.queryparam.apikey"/>
</VerifyAPIKey>

<!-- Quota Policy - Monthly limit -->
<Quota name="QuotaPolicy">
  <Interval>1</Interval>
  <TimeUnit>month</TimeUnit>
  <Allow count="10000"/>  <!-- 10k requests per month -->
</Quota>

<!-- Assign Message Policy - Add header -->
<AssignMessage name="AddCorsHeaders">
  <Set>
    <Headers>
      <Header name="Access-Control-Allow-Origin">*</Header>
      <Header name="Access-Control-Allow-Methods">GET, POST, OPTIONS</Header>
    </Headers>
  </Set>
</AssignMessage>

<!-- JavaScript Policy - Custom logic -->
<Javascript name="ProcessRequest">
  <ResourceURL>jsc://process-request.js</ResourceURL>
</Javascript>

<!-- Service Callout - Call another API -->
<ServiceCallout name="GetUserProfile">
  <Request>
    <Set>
      <Verb>GET</Verb>
      <Url>https://users-api.internal/users/{user.id}</Url>
    </Set>
  </Request>
  <Response>user.profile</Response>
</ServiceCallout>

# Install Istio on Kubernetes
curl -L https://istio.io/downloadIstio | sh -
cd istio-1.24.0
export PATH=$PWD/bin:$PATH

# Install Istio with demo profile
istioctl install --set profile=demo -y

# Label namespace for sidecar injection
kubectl label namespace default istio-injection=enabled

# Deploy your app - Istio auto-injects sidecar
kubectl apply -f your-app.yaml

# VirtualService - Traffic routing
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            user:
              exact: "john"
      route:
        - destination:
            host: reviews
            subset: v2  # John sees v2
    - route:
        - destination:
            host: reviews
            subset: v1  # Everyone else sees v1
          weight: 90
        - destination:
            host: reviews
            subset: v2
          weight: 10    # 10% get v2 (canary)

# Install Linkerd CLI
curl -sL https://run.linkerd.io/install | sh
export PATH=$PATH:$HOME/.linkerd2/bin

# Check prerequisites
linkerd check --pre

# Install Linkerd on Kubernetes
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -

# Verify installation
linkerd check

# Inject sidecar into deployment
kubectl get deploy -o yaml | linkerd inject - | kubectl apply -f -

# Or annotate namespace for auto-injection
kubectl annotate namespace default linkerd.io/inject=enabled

# View dashboard
linkerd dashboard

# Traffic split (canary deployment)
apiVersion: split.smi-spec.io/v1alpha2
kind: TrafficSplit
metadata:
  name: reviews-split
spec:
  service: reviews
  backends:
    - service: reviews-v1
      weight: 90    # 90% to v1
    - service: reviews-v2
      weight: 10    # 10% to v2 (canary)

# Mobile BFF endpoint
@app.get("/mobile/products/{product_id}")
async def get_product_for_mobile(product_id: int):
    """
    Aggregates data from multiple services into mobile-optimized response.
    Makes parallel calls to reduce latency.
    """
    # Parallel calls to backend microservices
    product, reviews, stock, recommendations = await asyncio.gather(
        products_service.get_product(product_id),
        reviews_service.get_top_reviews(product_id, limit=3),
        inventory_service.get_stock(product_id),
        recommendations_service.get_similar(product_id, limit=5)
    )

    # Transform to mobile-friendly format
    return {
        "id": product.id,
        "name": product.name,
        "price": product.price,
        "currency": "USD",
        "image_url": product.images[0].url,  # Mobile: just thumbnail
        "rating": product.avg_rating,
        "in_stock": stock.available > 0,
        "reviews": [
            {
                "author": r.author_name,
                "rating": r.rating,
                "text": r.text[:100],  # Mobile: truncated
            }
            for r in reviews
        ],
        "similar_products": [
            {"id": p.id, "name": p.name, "image": p.thumbnail}
            for p in recommendations
        ]
    }

# Web BFF endpoint - different data shape
@app.get("/web/products/{product_id}")
async def get_product_for_web(product_id: int):
    """
    Web needs more detail: full reviews (paginated), all images, detailed specs.
    """
    product, reviews, stock = await asyncio.gather(
        products_service.get_product(product_id),
        reviews_service.get_reviews(product_id, page=1, limit=10),
        inventory_service.get_stock(product_id)
    )

    return {
        "id": product.id,
        "name": product.name,
        "price": product.price,
        "currency": "USD",
        "images": [img.url for img in product.images],  # All images
        "description": product.description,  # Full description
        "specs": product.specifications,  # Detailed specs
        "rating": product.avg_rating,
        "stock_count": stock.available,  # Exact count for web
        "reviews": {
            "items": [
                {
                    "author": r.author_name,
                    "rating": r.rating,
                    "text": r.text,  # Full text
                    "date": r.created_at.isoformat(),
                }
                for r in reviews.items
            ],
            "total": reviews.total,
            "page": 1,
        }
    }