Kong API Gateway and Docusign Extension Apps

This repo describes how to configure Kong API Gateway to protect Docusign Extension Apps. The Reference Architecture is below:

The main components are:

• Konnect Control Plane: responsible for defining APIs and Policies and pushing them to the Kong API Gateway Data Plane.
• Kong API Data Plane: responsible for protecting with Microservices implementing the Application logic with the Policies described in the Control Plane, such as Rate Limiting, Authentication, etc.
• Kong Identity: plays the Identity Provider (IdP) role, implementing OAuth2 Grants, such as Authorization Code and Client Credentials.
• DataIO Microservices: implement the actual Application.
• Docusign Developer: creates and deploys the Docusign Extension App.
• Docusign Workflow Builder: orchestrates the end-to-end agreement workflow, including web forms, data operations, and conditional routing.

The DataIO Microservices are protected by an OpenId Connect Grant, where the Docusign Extension App is responsible for hitting the Identity Provider, implemented by Kong Identity, to get an Access Token. The Access Token is injected to all requests sent to Kong Data Plane which validates the Access Token before routing the request to the actual DataIO Microservices.

Other Policies can also be defined in Kong Konnect Control Plane and enforced by Kong Data Plane, please check the Konnect Plugin Hub portal to learn more about them. Each Kong Plugin implements a specific policy, including Transformation, Security, Authentication, Traffic Control, etc.

This repo contains artifacts to deploy Kong Data Plane in an Amazon Elastic Kubernetes Service (EKS) Cluster. Kong supports several other platforms including other Kubernetes distributions, VMs, Docker-based runtimes, etc. Check the Kong Gateway installation page to learn more.

To have your own deployment read the instructions described in the following order:

1. AWS and EKS
2. Konnect Control Plane and Data Plane
3. Docusign Extension App - Development Time
4. Docusign Extension App - Production Time
5. Kong Identity

Register to both:

• Kong Konnect
• Docusign

Install Required Tools

If you follow all guides in this repository (EKS, Kong, Development Time, and Production Time), install the tools below first.

Required CLIs

• AWS CLI v2 - used for EKS, IAM, Route53, ACM, ELBv2, and ECR operations.
• eksctl - used to create and manage the EKS cluster and Pod Identity associations.
• kubectl - used to apply manifests and inspect Kubernetes resources.
• Helm - used to install the AWS Load Balancer Controller and Kong Operator.
• decK - used to configure Kong entities and plugins in Konnect control planes.
• jq - used in many commands to parse JSON responses and export environment variables.
• curl - used to call Kong/Konnect APIs and test gateway endpoints.

Required For App Build and Deployment

• Docker Desktop (or Docker Engine) - used to build and push the app image to ECR.
• Node.js 20 LTS (includes npm) - recommended to build and run the TypeScript app in the app/ folder.

Optional but Helpful

• Git - if you clone and version the project locally.

Accounts / Access You Need

• AWS Account with permissions for EKS, IAM, Route53, ACM, ELBv2, and ECR.
• Kong Konnect Account to create control planes and Kong Identity resources.
• Docusign Developer Account to create and test Extension Apps.

Quick Check

After installation, confirm your local setup:

aws --version
eksctl version
kubectl version --client
helm version
deck version
jq --version
curl --version
docker --version
node --version
npm --version