Kheper

Kheper is a tool designed to mock Kong Gateway data plane nodes for testing and developing your control plane. It simulates node behavior using standard and JSON RPC protocols, handles WebSocket events, manages pings, and processes configuration updates. Additionally, Kheper provides a RESTful API for inspecting the configuration received by each node, eliminating the need for a full Kong Gateway setup.

Features:

Simulates Kong Gateway data plane node connections to a control plane using multiple WebSocket protocols
- Supports both standard and JSON RPC protocols
Manages connections, pings, and configuration updates
Enables communication with multiple control planes for cross-region/environment testing
Offers simple configuration through YAML files or environment variables
Exposes a RESTful API for inspecting the configuration of each node
Supports the simulation of extensive network loads by creating thousands of mock Kong Gateway data plane nodes
Compatible with both OSS and Enterprise versions of Kong Gateway

Getting Started

Installation

To use Kheper, you'll need to have Go installed on your system. You can download and install Go from the official website.

Building Kheper

git clone https://github.com/mikefero/kheper.git
cd kheper
make build

Usage

Configuration

Kheper can be configured using a YAML file or environment variables. Below are the configuration options available:

Configuration Options

Kheper Admin API

YAML Key	Environment Variable	Description
`api.enabled`	`KHEPER_API_ENABLED`	Whether the admin API server should be enabled. (default: false)
`api.port`	`KHEPER_API_PORT`	The port to run the Aadmin PI server on. (default: 5000)
`api.timeouts.read`	`KHEPER_API_TIMEOUTS_READ`	The timeout for reading the request body. (default: 15s)
`api.timeouts.read_header`	`KHEPER_API_TIMEOUTS_READ_HEADER`	The timeout for reading the headers. (default: 15s)
`api.timeouts.write`	`KHEPER_API_TIMEOUTS_WRITE`	The timeout for writing the response. (default: 15s)

OpenTelemetry

YAML Key	Environment Variable	Description
`open_telemetry.enabled`	`KHEPER_OPEN_TELEMETRY_ENABLED`	Whether the OpenTelemetry collector should be enabled. (default: false)
`open_telemetry.host`	`KHEPER_OPEN_TELEMETRY_HOST`	The host of the OpenTelemetry collector. (default: localhost)
`open_telemetry.port`	`KHEPER_OPEN_TELEMETRY_PORT`	The port of the OpenTelemetry collector. (default: 4317)
`open_telemetry.service_name`	`KHEPER_OPEN_TELEMETRY_SERVICE_NAME`	The service name for the traces and metrics sent to the OpenTelemetry collector. (default: kheper)
`open_telemetry.metric_interval`	`KHEPER_OPEN_TELEMETRY_METRIC_INTERVAL`	The interval at which the OpenTelemetry collector should collect metrics. (default: 2s)
`open_telemetry.shutdown_interval`	`KHEPER_OPEN_TELEMETRY_SHUTDOWN_INTERVAL`	The interval at which the OpenTelemetry collector should shutdown. (default: 10s)

Global configurations

Node

YAML Key	Environment Variable	Description
`globals.node.handshake_timeout`	`KHEPER_GLOBALS_NODE_HANDSHAKE_TIMEOUT`	The amount of time allowed to complete the WebSocket handshake. (default: 15s)
`globals.node.node_creation_delay`	`KHEPER_GLOBALS_NODE_NODE_CREATION_DELAY`	The amount of time to wait before creating the next node. (default: 20ms)
`globals.node.ping_interval`	`KHEPER_GLOBALS_NODE_PING_INTERVAL`	The interval at which the node should ping the control plane. This interval must be greater than 0. (default: 15s)
`globals.node.ping_jitter`	`KHEPER_GLOBALS_NODE_PING_JITTER`	The jitter to apply to the ping interval. This jitter must be greater than 0. (default: 5s)
`globals.node.reconnection_interval`	`KHEPER_GLOBALS_NODE_RECONNECTION_INTERVAL`	The interval at which the node should attempt to reconnect to the control plane. This interval must be greater than 0.(default: 10s)
`globals.node.reconnection_jitter`	`KHEPER_GLOBALS_NODE_RECONNECTION_JITTER`	The jitter to apply to the reconnection interval. This jitter must be greater than 0. (default: 5s)

Nodes

YAML Key	Environment Variable	Description
`nodes.instances`	`KHEPER_NODES_INSTANCES`	The number of node instances to create. (default: 1)
`nodes.group`	`KHEPER_NODES_GROUP`	The name of the group to which the node instance belongs.
`nodes.hostname`	`KHEPER_NODES_HOSTNAME`	The RFC 1123 hostname of the node. This can be a `sequential` hostname or a specific hostname. when `sequential` is specified, a sequential hostname will be generated starting with `00000000-0000-4000-8000-000000000001` and incrementing by 1 hexadecimal digit for each node. (default: sequential)
`nodes.id`	`KHEPER_NODES_ID`	The unique ID of the node. This can be a `sequential`, `unique`, or a specific UUID. When `sequential` is specified, a sequential UUID will be generated starting with `00000000-0000-4000-8000-000000000001` and incrementing by 1 hexadecimal digit for each node. When `unique` is specified, a unique UUID will be generated. (default: sequential)
`nodes.required_payload_entities`	`KHEPER_NODES_REQUIRED_PAYLOAD_ENTITIES`	The entities that must be present in the payload sent from the control plane.
`nodes.versions`	`KHEPER_NODES_VERSIONS`	The Kong Gateway semantic versions of the node. This version can be represented as 3 or 4 integers separated by dots (e.g. 1.2.3 or 1.2.3.4). Each version in the slice will be "round-robin" across the nodes based on the number of instances. (default: 3.7.1)

Connection

YAML Key	Environment Variable	Description
`nodes.connection.host`	`KHEPER_NODES_CONNECTION_HOST`	The RFC 1123 IP address or hostname of the control plane to connect to.
`nodes.connection.port`	`KHEPER_NODES_CONNECTION_PORT`	The port of the control plane to connect to (range 1-65535).
`nodes.connection.protocol`	`KHEPER_NODES_CONNECTION_PROTOCOL`	The protocol to use to communicate with the control plane. Supported values are 'standard' and 'jsonrpc'. (default: standard)
`nodes.connection.cipher_suites`	`KHEPER_NODES_CONNECTION_CIPHER_SUITES`	The OpenSSL or TLS cipher suites to use when connecting to the control plane. Each cipher suite in the slice will be "round-robin" across the nodes based on the number of instances. If not specified, the default cipher suite will be used.
`nodes.connection.tls_version`	`KHEPER_NODES_CONNECTION_TLS_VERSION`	The TLS version to use when connecting to the control plane. If not specified, TLS v1.3 will be used.
`nodes.connection.certificate`	`KHEPER_NODES_CONNECTION_CERTIFICATE`	The TLS certificate in PEM format to use when connecting to the control plane.
`nodes.connection.key`	`KHEPER_NODES_CONNECTION_KEY`	The TLS key in PEM format to use when connecting to the control plane.

Cipher Suites

The Kheper application allows configuring various TLS cipher suites to ensure secure communication. The cipher suites can be specified using either the OpenSSL or TLS enumeration. Below is a table listing the supported cipher suites and their corresponding identifiers.

For more details on OpenSSL cipher suites, you can refer to the Kong Gateway constants. The mapping between OpenSSL cipher suites and their TLS counterparts were taken from the OpenSSL documentation.

Supported TLS Version

The Kheper application supports TLS versions 1.0 through 1.3. When configuring the application, it is important to note the following:

TLS v1.0, TLS v1.1, and TLS v1.2: Clients can specify the desired cipher suite.
TLS v1.3: The cipher suites are predefined and cannot be specified by the client. This version uses a fixed set of cipher suites that are considered secure and efficient. As a result, attempting to configure specific cipher suite when using TLS v1.3 will not have any effect.

Supported Cipher Suites

OpenSSL Identifier	TLS Identifier	Kong Gateway SSL Cipher Suite
ECDHE-RSA-AES128-GCM-SHA256	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	intermediate
ECDHE-RSA-AES256-GCM-SHA384	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	intermediate
ECDHE-RSA-CHACHA20-POLY1305	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256	intermediate
ECDHE-ECDSA-AES128-GCM-SHA256	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	intermediate
ECDHE-ECDSA-AES256-GCM-SHA384	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	intermediate
ECDHE-ECDSA-CHACHA20-POLY1305	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256	intermediate
ECDHE-ECDSA-AES128-SHA256	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	old
ECDHE-RSA-AES128-SHA256	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	old
ECDHE-RSA-AES128-SHA	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA	old
ECDHE-RSA-AES256-SHA	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	old
ECDHE-ECDSA-AES128-SHA	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA	old
ECDHE-ECDSA-AES256-SHA	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA	old
AES128-GCM-SHA256	TLS_RSA_WITH_AES_128_GCM_SHA256	old
AES256-GCM-SHA384	TLS_RSA_WITH_AES_256_GCM_SHA384	old
AES128-SHA256	TLS_RSA_WITH_AES_128_CBC_SHA256	old
AES128-SHA	TLS_RSA_WITH_AES_128_CBC_SHA	old
AES256-SHA	TLS_RSA_WITH_AES_256_CBC_SHA	old

The application currently does not support certain Kong Gateway cipher suites in Go, such as AES256-SHA256, DES-CBC3-SHA, DHE-RSA-AES128-GCM-SHA256, DHE-RSA-AES256-GCM-SHA384, DHE-RSA-CHACHA20-POLY1305, DHE-RSA-AES128-SHA256, DHE-RSA-AES256-SHA256. ECDHE-ECDSA-AES256-SHA384, and ECDHE-RSA-AES256-SHA384

For any unsupported cipher suite, an error will be returned indicating the unsupported status.

Example YAML Configuration

Here is an example YAML configuration file:

# Admin API server configuration
api:
  enabled: true
  port: 5000
  timeouts:
    read: 15s
    read_header: 15s
    write: 15s

# OpenTelemetry configuration
open_telemetry:
  enabled: true
  host: localhost
  port: 4317
  service_name: kheper
  metric_interval: 2s
  shutdown_interval: 10s

# Global configuration for various features of Kheper
globals:
  # Node Configurations that are shared across all nodes
  node:
    handshake_timeout: 15s
    node_creation_delay: 20ms
    ping_interval: 15s
    ping_jitter: 5s
    reconnection_interval: 10s
    reconnection_jitter: 5s

# Node configuration for single or multiple control planes
nodes:
  - instances: 8
    hostname: sequential
    id: sequential
    require_payload_entities:
      - parameters
    versions:
      - 3.4.0
      - 3.4.1
      - 3.4.2
      - 3.5.0
      - 3.6.0
      - 3.6.1
      - 3.7.0
      - 3.7.1
    connection:
      host: localhost
      port: 8005
      protocol: standard
      cipher_suites:
        - ECDHE-ECDSA-AES128-GCM-SHA256
        - ECDHE-ECDSA-AES256-GCM-SHA384
        - ECDHE-ECDSA-CHACHA20-POLY1305
        - ECDHE-ECDSA-AES128-SHA256
        - ECDHE-ECDSA-AES128-SHA
        - ECDHE-ECDSA-AES256-SHA
      tls_version: TLSv1.2
      certificate: |
        -----BEGIN CERTIFICATE-----
        MIIBkTCCATegAwIBAgIUNafcmtDPirW6BY512Kn4LVm49ggwCgYIKoZIzj0EAwIw
        HTEbMBkGA1UEAwwSa2hlcGVyLmV4YW1wbGUuY29tMCAXDTI0MDcxNTE1NTExNloY
        DzIxMjQwNjIxMTU1MTE2WjAdMRswGQYDVQQDDBJraGVwZXIuZXhhbXBsZS5jb20w
        WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
        WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CPo1MwUTAd
        BgNVHQ4EFgQU5qSZisQi+Gg5b/W8ianbh9+f1DcwHwYDVR0jBBgwFoAU5qSZisQi
        +Gg5b/W8ianbh9+f1DcwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBF
        AiBxcYu26lPkyxqDjas6gAXIuyJLK4IlDkvkRQxU0Ko9zAIhAJF0vuSPLvp+4L/G
        rrfgvmrE10iZPEm0/Iq2vlF/hZ63
        -----END CERTIFICATE-----
      key: |
        -----BEGIN PRIVATE KEY-----
        MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgc5u/SwkNIuzrCMxr
        IxFc1FAzG1O4Rfm6lWxrFVrTAvahRANCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
        WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CP
        -----END PRIVATE KEY-----

Example Environment Variables Configuration

You can override the YAML configuration using environment variables:

# API
export KHEPER_API_ENABLED=true
export KHEPER_API_PORT=5000
export KHEPER_API_TIMEOUTS_READ=15s
export KHEPER_API_TIMEOUTS_READ_HEADER=15s
export KHEPER_API_TIMEOUTS_WRITE=15s

# OpenTelemetry configuration
export KHEPER_OPEN_TELEMETRY_ENABLED=true
export KHEPER_OPEN_TELEMETRY_HOST=localhost
export KHEPER_OPEN_TELEMETRY_PORT=4317
export KHEPER_OPEN_TELEMETRY_SERVICE_NAME=kheper
export KHEPER_OPEN_TELEMETRY_METRIC_INTERVAL=2s
export KHEPER_OPEN_TELEMETRY_SHUTDOWN_INTERVAL=10s

# Shared node configuration
export KHEPER_GLOBALS_NODE_HANDSHAKE_TIMEOUT=15s
export KHEPER_GLOBALS_NODE_NODE_CREATION_DELAY=20ms
export KHEPER_GLOBALS_NODE_PING_INTERVAL=15s
export KHEPER_GLOBALS_NODE_PING_JITTER=5s
export KHEPER_GLOBALS_NODE_RECONNECTION_INTERVAL=10s
export KHEPER_GLOBALS_NODE_RECONNECTION_JITTER=5s

# Nodes
export KHEPER_NODES_INSTANCES=14
export KHEPER_NODES_HOSTNAME=sequential
export KHEPER_NODES_ID=sequential
export KHEPER_NODES_REQUIRED_PAYLOAD_ENTITIES=parameters
export KHEPER_NODES_VERSIONS=3.7.1,3.7.0
export KHEPER_NODES_CONNECTION_HOST=localhost
export KHEPER_NODES_CONNECTION_PORT=8005
export KHEPER_NODES_CONNECTION_PROTOCOL=standard
export KHEPER_NODES_CONNECTION_CIPHER_SUITE="ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES128-SHA256,ECDHE-ECDSA-AES128-SHA,ECDHE-ECDSA-AES256-SHA"
export KHEPER_NODES_CONNECTION_TLS_VERSION=TLSv1.2
export KHEPER_NODES_CONNECTION_CERTIFICATE="-----BEGIN CERTIFICATE-----
MIIBkTCCATegAwIBAgIUNafcmtDPirW6BY512Kn4LVm49ggwCgYIKoZIzj0EAwIw
HTEbMBkGA1UEAwwSa2hlcGVyLmV4YW1wbGUuY29tMCAXDTI0MDcxNTE1NTExNloY
DzIxMjQwNjIxMTU1MTE2WjAdMRswGQYDVQQDDBJraGVwZXIuZXhhbXBsZS5jb20w
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CPo1MwUTAd
BgNVHQ4EFgQU5qSZisQi+Gg5b/W8ianbh9+f1DcwHwYDVR0jBBgwFoAU5qSZisQi
+Gg5b/W8ianbh9+f1DcwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBF
AiBxcYu26lPkyxqDjas6gAXIuyJLK4IlDkvkRQxU0Ko9zAIhAJF0vuSPLvp+4L/G
rrfgvmrE10iZPEm0/Iq2vlF/hZ63
-----END CERTIFICATE-----"
export KHEPER_NODES_CONNECTION_KEY="-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgc5u/SwkNIuzrCMxr
IxFc1FAzG1O4Rfm6lWxrFVrTAvahRANCAARnfTV7waofWrgsN86ueBRl+HuF5+3B
WQgRxu0s1XJqvEgTCsMObNo5c87PA9NpmP2t0O2S8mjonJ2VUOE896CP
-----END PRIVATE KEY-----"

Hostname and ID

nodes.hostname and KHEPER_NODES_HOSTNAME: The RFC 1123 hostname of the node.
- If sequential is specified, a sequential hostname will be generated.
nodes.id and KHEPER_NODES_ID: The unique ID of the node.
- If sequential is specified, a sequential ID will be generated.
- If unique is specified, a unique ID will be generated as a random UUID.

Note: If a specific value is provided for hostname or id, it will be used as-is. However, if instances is greater than 1, the same hostname and id will be duplicated for each instance.

Running Kheper

To run Kheper, use the following command:

./bin/kheper

Admin API for Kheper Mock Data Plane Node Application

The Kheper Mock Data Plane Node Application provides an Admin API to manage and retrieve information about hosts and nodes connected to control planes. This API allows users to list all hosts, nodes connected to a specific host, retrieve specific nodes, and access particular resources from a node's payload. Below are the available endpoints and their functionalities:

Endpoints

When OpenTelemetry is enabled, the response will contain the following headers:

X-Span-Id: The span context of the request.
X-Trace-Id: The trace ID of the request.

List All Groups

Endpoint: /v1/groups
Method: GET
Summary: Retrieve a list of all groups for data plane nodes connected to control planes.

[
  "kong-gateway-oss",
  "kong-gateway-enterprise"
]

List All Nodes Connected to a Group

Endpoint: /v1/groups/{group}
Method: GET
Summary: Retrieve a list of all nodes connected to a specific group.
Parameters:
- group: The name of the group.

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node1.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3"
  },
  {
    "id": "223e4567-e89b-12d3-a456-426614174001",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node2.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3.1"
  }
]

List All Hosts

Endpoint: /v1/hosts
Method: GET
Summary: Retrieve a list of all hosts for data plane nodes connected to control planes.

[
  {
    "hostname": "example-host1.com"
  },
  {
    "groups": [
      "kong-gateway-oss",
    ],
    "hostname":"example-host2.com"
  }
]

List All Nodes Connected to a Host

Endpoint: /v1/hosts/{host}
Method: GET
Summary: Retrieve a list of all nodes connected to a specific host or address.
Parameters:
- host: The IP address or hostname of the control plane.

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node1.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3"
  },
  {
    "id": "223e4567-e89b-12d3-a456-426614174001",
    "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
    "hostname": "node2.example-host.com",
    "tls_version": "TLSv1.2",
    "version": "1.2.3.1"
  }
]

Retrieve a Specific Node

Endpoint: /v1/hosts/{host}/{node-id}
Method: GET
Summary: Retrieve a specific node.
Parameters:
- host: The IP address or hostname of the control plane.
- node-id: The node ID in UUID format.

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "cipher_suite": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "kong-gateway-oss",
  "hostname": "node1.example-host.com",
  "tls_version": "TLSv1.2",
  "version": "1.2.3",
  "payload": {
    "config_hash": "374d97a6cdede7dbe918d7e72c29e6c8",
    "config_table": {
      "_format_version": "3.0",
      "_transform": false,
      "parameters": [
        {
          "created_at": 1719610962,
          "key": "cluster_id",
          "value": "46956d6b-4d94-4621-8663-87302bf5b18e"
        }
      ],
      "workspaces": [
        {
          "comment": "default workspace",
          "config": {},
          "created_at": 1719610962,
          "id": "0b38010c-9279-4c3e-a669-9b4f977a1efa",
          "meta": {},
          "name": "default",
          "updated_at": 1719610962
        }
      ]
    },
    "hashes": {
      "config": "374d97a6cdede7dbe918d7e72c29e6c8",
      "plugins": "00000000000000000000000000000000",
      "routes": "00000000000000000000000000000000",
      "services": "00000000000000000000000000000000",
      "targets": "00000000000000000000000000000000"
    },
    "timestamp": 1719750771.23,
    "type": "reconfigure"
  }
}

Retrieve a Specific Resource from a Node Payload

Endpoint: /v1/hosts/{host}/{node-id}/{resource}
Method: GET
Summary: Retrieve a specific resource from the root level of the config_table in the payload JSON object of a node.
Parameters:
- host: The IP address or hostname of the control plane.
- node-id: The node ID in UUID format.
- resource: The resource name.

{
  "data": [
    {
      "ca_certificates": null,
      "client_certificate": null,
      "connect_timeout": 60000,
      "created_at": 1719863489,
      "enabled": true,
      "host": "kheper.local",
      "id": "3ec50d85-808a-4ddc-9d72-d5a29fa30aa3",
      "name": "kheper",
      "path": null,
      "port": 80,
      "protocol": "http",
      "read_timeout": 60000,
      "retries": 5,
      "tags": null,
      "tls_verify": null,
      "tls_verify_depth": null,
      "updated_at": 1719863489,
      "write_timeout": 60000
    }
  ],
  "next": null
}

Generating a Certificate and Key Pair

Here is an example of how to generate a certificate and key pair using OpenSSL for multiple cipher suites:

Elliptic Curve Key Pair

openssl req \
  -new \
  -newkey ec:<(openssl ecparam -name prime256v1) \
  -keyout docker/kong/cluster_ec.key \
  -nodes \
  -x509 \
  -days 36500 \
  -out docker/kong/cluster_ec.crt \
  -subj "/CN=kheper.example.com"

RSA Key Pair

openssl req \
  -new \
  -newkey rsa:2048 \
  -keyout docker/kong/cluster_rsa.key \
  -nodes \
  -x509 \
  -days 36500 \
  -out docker/kong/cluster_rsa.crt \
  -subj "/CN=kheper.example.com"

This command generates a new self-signed X.509 certificate valid for 100 years using an elliptic curve key with the prime256v1 curve. It outputs the private key to cluster_ec.key and the certificate to cluster_ec.crt, with the common name (CN) set to kheper.example.com. This PEM-encoded certificate and key can be used as the certificate and key values in the YAML configuration along with the Kong Gateway control plane cluster_cert and cluster_cert_key configuration fields.

Note: A cluster_ec.crt and cluster_ec.key file are included in the repository for convenience and are used in the yaml configuration file example. Additionally cluster_rsa.crt and cluster_rsa.key are included for completeness in order to utilize all cipher suites.

Testing With Kong Gateway

To test Kheper with Kong Gateway, you can use the following commands to start and stop Kong Gateway:

make kong-up
make kong-down

To have the containers log to stdout, you can use the following command:

make kong-up-stdout

Testing With Jaeger, Grafana, and Prometheus

To test Kheper with Jaeger, Grafana, and Prometheus, you can use the following commands to start and stop the services which will allow the metrics to be viewed:

make monitoring-up
make monitoring-down