OpenResty

We use NGINX and OpenResty as our API proxy running on EC2 for auth, caching, and some rate limiting for our dozens of microservices. Since OpenResty support embedded Lua we were able to write a custom access module that calls out to our authentication service with the resource, method, and access token. If that succeeds then critical account info is passed down to the underlying microservice. This proxy approach keeps all authentication and authorization in one place and provides a unified CX for our API users. Nginx is fast and cheap to run though we are always exploring alternatives that are also economical. What do you use?

At Kong while building an internal tool, we struggled to route metrics to Prometheus and logs to Logstash without incurring too much latency in our metrics collection.

We replaced NGINX with OpenResty on the edge of our tool which allowed us to use the lua-nginx-module to run Lua code that captures metrics and records telemetry data during every request’s log phase. Our code then pushes the metrics to a local aggregator process (written in Golang) which in turn exposes them in Prometheus Exposition Format for consumption by Prometheus. This solution reduced the number of components we needed to maintain and is fast thanks to NGINX and LuaJIT.

Kong is built on OpenResty because it allows us to extend NGINX with Lua scripts through the ngx_lua module. OpenResty bundles this module as well as many others, providing a powerful server for developers to extend.

We could have built a modular reverse proxy on NGINX either by bundling Nginx with our own flavor of 3rd party modules or by developing on top of OpenResty. We admired the work done on OpenResty and thought of a way to build a modulable core, on which plugins could be added. Hence, Kong is mostly a collection of Lua scripts that allow it to execute plugins at runtime for routes and services.

This decision is an adaptation of a Quora answer originally written by Thibault Charbonnier.

I use OpenResty because it combines a high-performance, battled-tested network/protocol handler, with the facilities to write both prototype- and production-grade code in a performant runtime. We can easily test complex and prove complex business logic in a highly-performant (on the scale of hundreds of thousands of requests per second) environment, without worrying about maintaining a lot of plumbing code.