# 範例：查詢所有 Services
curl -X GET http://localhost:8001/services

# 範例：新增一個 Service
curl -X POST http://localhost:8001/services \
  --data name=my-service \
  --data url=http://backend:8080

# 1. 建立設定檔 kong.yml
cat > kong.yml <<EOF
_format_version: "3.0"

services:
  - name: demo-service
    url: http://httpbin.org
    routes:
      - name: demo-route
        paths:
          - /demo
EOF

# 2. 啟動 Kong（DB-less）
docker run -d --name kong \
  -e "KONG_DATABASE=off" \
  -e "KONG_DECLARATIVE_CONFIG=/kong/declarative/kong.yml" \
  -e "KONG_PROXY_ACCESS_LOG=/dev/stdout" \
  -e "KONG_ADMIN_ACCESS_LOG=/dev/stdout" \
  -e "KONG_PROXY_ERROR_LOG=/dev/stderr" \
  -e "KONG_ADMIN_ERROR_LOG=/dev/stderr" \
  -e "KONG_ADMIN_LISTEN=0.0.0.0:8001" \
  -v "$(pwd)/kong.yml:/kong/declarative/kong.yml:ro" \
  -p 8000:8000 \
  -p 8001:8001 \
  kong:3.9

# docker-compose.yml
version: '3.8'

services:
  kong-database:
    image: postgres:15-alpine
    container_name: kong-database
    environment:
      POSTGRES_USER: kong
      POSTGRES_PASSWORD: kongpass
      POSTGRES_DB: kong
    volumes:
      - kong_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kong"]
      interval: 10s
      timeout: 5s
      retries: 5

  kong-migration:
    image: kong:3.9
    command: kong migrations bootstrap
    depends_on:
      kong-database:
        condition: service_healthy
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_USER: kong
      KONG_PG_PASSWORD: kongpass
    restart: on-failure

  kong:
    image: kong:3.9
    container_name: kong
    depends_on:
      kong-migration:
        condition: service_completed_successfully
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_USER: kong
      KONG_PG_PASSWORD: kongpass
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_ADMIN_LISTEN: 0.0.0.0:8001
      KONG_PROXY_LISTEN: 0.0.0.0:8000, 0.0.0.0:8443 ssl
    ports:
      - "8000:8000"   # Proxy HTTP
      - "8443:8443"   # Proxy HTTPS
      - "8001:8001"   # Admin API
    healthcheck:
      test: ["CMD", "kong", "health"]
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped

volumes:
  kong_data:

# 啟動所有服務
docker-compose up -d

# 檢查狀態
docker-compose ps

# 查看 Kong 日誌
docker-compose logs -f kong

# 1. 新增 Kong Helm Repo
helm repo add kong https://charts.konghq.com
helm repo update

# 2. 建立 namespace
kubectl create namespace kong

# 3. 安裝 Kong（DB-less 模式 + Ingress Controller）
helm install kong kong/kong \
  --namespace kong \
  --set ingressController.installCRDs=false \
  --set env.database=off \
  --set admin.enabled=true \
  --set admin.http.enabled=true

# 4. 安裝 Kong（DB-backed 模式）
helm install kong kong/kong \
  --namespace kong \
  --set env.database=postgres \
  --set postgresql.enabled=true \
  --set postgresql.auth.username=kong \
  --set postgresql.auth.password=kongpass \
  --set admin.enabled=true

# kong-ingress.yaml
apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
  name: demo-kong-ingress
route:
  strip_path: true
  preserve_host: false
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo-ingress
  annotations:
    konghq.com/override: demo-kong-ingress
spec:
  ingressClassName: kong
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /demo
            pathType: Prefix
            backend:
              service:
                name: demo-service
                port:
                  number: 80

# 1. 檢查 Kong 版本
curl -s http://localhost:8001 | jq '.version'

# 2. 檢查節點狀態
curl -s http://localhost:8001/status | jq

# 3. 檢查已載入的 Plugin
curl -s http://localhost:8001/plugins/enabled | jq

# 4. 測試 Proxy 功能（需先設定 Service/Route）
curl -i http://localhost:8000/demo

# 5. 健康檢查端點
curl -s http://localhost:8001/status | jq '.database.reachable'

{
  "database": {
    "reachable": true
  },
  "memory": {
    "workers_lua_vms": [...],
    "lua_shared_dicts": {...}
  },
  "server": {
    "connections_active": 1,
    "connections_accepted": 10,
    "connections_handled": 10,
    "connections_reading": 0,
    "connections_writing": 1,
    "connections_waiting": 0,
    "total_requests": 50
  }
}

# 建立 Service（直接指定 URL）
curl -X POST http://localhost:8001/services \
  --data name=user-service \
  --data url=http://user-backend:8080

# 建立 Service（指定 Upstream）
curl -X POST http://localhost:8001/services \
  --data name=user-service \
  --data host=user-upstream \
  --data port=80 \
  --data protocol=http

# 建立 Route
curl -X POST http://localhost:8001/services/user-service/routes \
  --data name=user-route \
  --data "paths[]=/api/users" \
  --data "methods[]=GET" \
  --data "methods[]=POST" \
  --data strip_path=true

# 建立 Upstream
curl -X POST http://localhost:8001/upstreams \
  --data name=user-upstream \
  --data algorithm=round-robin

# 新增 Target（後端實例）
curl -X POST http://localhost:8001/upstreams/user-upstream/targets \
  --data target=user-backend-1:8080 \
  --data weight=100

curl -X POST http://localhost:8001/upstreams/user-upstream/targets \
  --data target=user-backend-2:8080 \
  --data weight=100

# 建立 Consumer
curl -X POST http://localhost:8001/consumers \
  --data username=mobile-app \
  --data custom_id=app-001

# 為 Consumer 建立認證憑證（API Key）
curl -X POST http://localhost:8001/consumers/mobile-app/key-auth \
  --data key=my-secret-api-key

# 全域（所有請求）
curl -X POST http://localhost:8001/plugins \
  --data name=rate-limiting \
  --data config.minute=100

# Service 層級
curl -X POST http://localhost:8001/services/user-service/plugins \
  --data name=rate-limiting \
  --data config.minute=50

# Route 層級
curl -X POST http://localhost:8001/routes/user-route/plugins \
  --data name=rate-limiting \
  --data config.minute=20

# Consumer 層級
curl -X POST http://localhost:8001/consumers/mobile-app/plugins \
  --data name=rate-limiting \
  --data config.minute=1000

# kong.yml
_format_version: "3.0"
_transform: true

services:
  - name: user-service
    url: http://user-backend:8080
    routes:
      - name: user-route
        paths:
          - /api/users
        strip_path: true
    plugins:
      - name: rate-limiting
        config:
          minute: 100
          policy: local

  - name: order-service
    url: http://order-backend:8080
    routes:
      - name: order-route
        paths:
          - /api/orders
        methods:
          - GET
          - POST

consumers:
  - username: mobile-app
    keyauth_credentials:
      - key: mobile-app-key-001

plugins:
  - name: prometheus
  - name: correlation-id
    config:
      header_name: X-Request-ID
      generator: uuid

# 方式 1：啟動時載入
docker run -e KONG_DECLARATIVE_CONFIG=/kong.yml ...

# 方式 2：透過 Admin API 動態載入
curl -X POST http://localhost:8001/config \
  -F config=@kong.yml

# 列出所有 Services
curl -s http://localhost:8001/services | jq

# 列出所有 Routes
curl -s http://localhost:8001/routes | jq

# 列出所有 Plugins
curl -s http://localhost:8001/plugins | jq

# 列出特定 Service 的 Routes
curl -s http://localhost:8001/services/user-service/routes | jq

# 列出所有 Consumers
curl -s http://localhost:8001/consumers | jq

# Step 1: 建立 Service
curl -X POST http://localhost:8001/services \
  --data name=demo-service \
  --data url=http://httpbin.org

# Step 2: 建立 Route
curl -X POST http://localhost:8001/services/demo-service/routes \
  --data name=demo-route \
  --data "paths[]=/api/demo" \
  --data strip_path=true

# Step 3: 測試
curl -i http://localhost:8000/api/demo/get

HTTP/1.1 200 OK
Content-Type: application/json
...

{
  "args": {},
  "headers": {
    "Host": "httpbin.org",
    ...
  },
  "origin": "...",
  "url": "http://httpbin.org/get"
}

# /api/v1/users → user-service-v1
curl -X POST http://localhost:8001/services/user-service-v1/routes \
  --data "paths[]=/api/v1/users"

# /api/v2/users → user-service-v2
curl -X POST http://localhost:8001/services/user-service-v2/routes \
  --data "paths[]=/api/v2/users"

# api.example.com → external-api-service
curl -X POST http://localhost:8001/services/external-api/routes \
  --data "hosts[]=api.example.com"

# internal-api.local → internal-api-service
curl -X POST http://localhost:8001/services/internal-api/routes \
  --data "hosts[]=internal-api.local"

# GET /users → user-read-service
curl -X POST http://localhost:8001/services/user-read-service/routes \
  --data "paths[]=/users" \
  --data "methods[]=GET"

# POST, PUT, DELETE /users → user-write-service
curl -X POST http://localhost:8001/services/user-write-service/routes \
  --data "paths[]=/users" \
  --data "methods[]=POST" \
  --data "methods[]=PUT" \
  --data "methods[]=DELETE"

# Step 1: 建立 Upstream
curl -X POST http://localhost:8001/upstreams \
  --data name=user-upstream \
  --data algorithm=round-robin \
  --data healthchecks.active.healthy.interval=5 \
  --data healthchecks.active.unhealthy.interval=5 \
  --data healthchecks.active.http_path=/health \
  --data healthchecks.active.healthy.successes=2 \
  --data healthchecks.active.unhealthy.http_failures=3

# Step 2: 新增 Targets
curl -X POST http://localhost:8001/upstreams/user-upstream/targets \
  --data target=user-backend-1:8080 \
  --data weight=100

curl -X POST http://localhost:8001/upstreams/user-upstream/targets \
  --data target=user-backend-2:8080 \
  --data weight=100

curl -X POST http://localhost:8001/upstreams/user-upstream/targets \
  --data target=user-backend-3:8080 \
  --data weight=50  # 權重較低，分配較少流量

# Step 3: 建立 Service 指向 Upstream
curl -X POST http://localhost:8001/services \
  --data name=user-service \
  --data host=user-upstream

# Step 4: 建立 Route
curl -X POST http://localhost:8001/services/user-service/routes \
  --data "paths[]=/api/users"

# YAML 設定範例
upstreams:
  - name: user-upstream
    algorithm: round-robin
    healthchecks:
      active:
        http_path: /health
        healthy:
          interval: 5
          successes: 2
        unhealthy:
          interval: 5
          http_failures: 3
          tcp_failures: 3
          timeouts: 3
      passive:
        healthy:
          successes: 5
        unhealthy:
          http_failures: 5
          tcp_failures: 5
          timeouts: 5

# 全域限流：每分鐘 100 次
curl -X POST http://localhost:8001/plugins \
  --data name=rate-limiting \
  --data config.minute=100 \
  --data config.policy=local

# 針對特定 Service
curl -X POST http://localhost:8001/services/user-service/plugins \
  --data name=rate-limiting \
  --data config.minute=50 \
  --data config.hour=1000 \
  --data config.policy=redis \
  --data config.redis_host=redis \
  --data config.redis_port=6379

# Step 1: 啟用 Key Auth Plugin
curl -X POST http://localhost:8001/services/user-service/plugins \
  --data name=key-auth \
  --data config.key_names=apikey \
  --data config.hide_credentials=true

# Step 2: 建立 Consumer
curl -X POST http://localhost:8001/consumers \
  --data username=partner-app

# Step 3: 為 Consumer 建立 API Key
curl -X POST http://localhost:8001/consumers/partner-app/key-auth \
  --data key=partner-secret-key-001

# Step 4: 測試
curl -i http://localhost:8000/api/users \
  -H "apikey: partner-secret-key-001"

# Step 1: 啟用 JWT Plugin
curl -X POST http://localhost:8001/services/user-service/plugins \
  --data name=jwt \
  --data config.claims_to_verify=exp

# Step 2: 建立 Consumer
curl -X POST http://localhost:8001/consumers \
  --data username=jwt-user

# Step 3: 為 Consumer 建立 JWT 憑證
curl -X POST http://localhost:8001/consumers/jwt-user/jwt \
  --data algorithm=HS256 \
  --data key=my-jwt-issuer \
  --data secret=my-jwt-secret

# Step 4: 產生 JWT Token（範例）
# Header: {"alg": "HS256", "typ": "JWT"}
# Payload: {"iss": "my-jwt-issuer", "exp": 1893456000}
# 使用 secret 簽名

# Step 5: 測試
curl -i http://localhost:8000/api/users \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

# 建立 RSA Key Pair 的 JWT 憑證
curl -X POST http://localhost:8001/consumers/jwt-user/jwt \
  --data algorithm=RS256 \
  --data key=my-jwt-issuer \
  --data rsa_public_key="-----BEGIN PUBLIC KEY-----..."

# 與 Keycloak 整合範例（驗證 JWT）
curl -X POST http://localhost:8001/plugins \
  --data name=jwt \
  --data config.uri_param_names=access_token \
  --data config.claims_to_verify=exp

# Step 1: 啟用 ACL Plugin
curl -X POST http://localhost:8001/services/admin-service/plugins \
  --data name=acl \
  --data config.allow=admin-group \
  --data config.hide_groups_header=true

# Step 2: 將 Consumer 加入群組
curl -X POST http://localhost:8001/consumers/admin-user/acls \
  --data group=admin-group

# 需搭配認證 Plugin（如 Key Auth）一起使用

curl -X POST http://localhost:8001/services/user-service/plugins \
  --data name=cors \
  --data "config.origins[]=https://app.example.com" \
  --data "config.methods[]=GET" \
  --data "config.methods[]=POST" \
  --data "config.methods[]=PUT" \
  --data "config.methods[]=DELETE" \
  --data "config.headers[]=Content-Type" \
  --data "config.headers[]=Authorization" \
  --data config.credentials=true \
  --data config.max_age=3600

# Request Transformer：添加 Header
curl -X POST http://localhost:8001/services/user-service/plugins \
  --data name=request-transformer \
  --data "config.add.headers[]=X-Custom-Header:custom-value" \
  --data "config.add.headers[]=X-Request-Source:kong" \
  --data "config.remove.headers[]=X-Forwarded-Host"

# Response Transformer：修改回應
curl -X POST http://localhost:8001/services/user-service/plugins \
  --data name=response-transformer \
  --data "config.add.headers[]=X-Kong-Proxy:true" \
  --data "config.remove.headers[]=Server"

# 啟用 Prometheus Plugin（全域）
curl -X POST http://localhost:8001/plugins \
  --data name=prometheus \
  --data config.per_consumer=true \
  --data config.status_code_metrics=true \
  --data config.latency_metrics=true \
  --data config.bandwidth_metrics=true \
  --data config.upstream_health_metrics=true

# Prometheus 端點
curl http://localhost:8001/metrics

curl -X POST http://localhost:8001/plugins \
  --data name=file-log \
  --data config.path=/var/log/kong/access.log \
  --data config.reopen=true

curl -X POST http://localhost:8001/plugins \
  --data name=http-log \
  --data config.http_endpoint=http://logstash:5044 \
  --data config.method=POST \
  --data config.content_type="application/json" \
  --data config.timeout=10000 \
  --data config.keepalive=60000

curl -X POST http://localhost:8001/plugins \
  --data name=tcp-log \
  --data config.host=logstash \
  --data config.port=5000

// 使用 API Key
const response = await fetch('https://api.example.com/api/users', {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
    'apikey': 'your-api-key'
  }
});

// 使用 JWT Token
const response = await fetch('https://api.example.com/api/users', {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${accessToken}`
  }
});

@Service
public class ApiService {
    
    private final RestTemplate restTemplate;
    
    @Value("${kong.api.base-url}")
    private String kongBaseUrl;
    
    @Value("${kong.api.key}")
    private String apiKey;
    
    public UserResponse getUsers() {
        HttpHeaders headers = new HttpHeaders();
        headers.set("apikey", apiKey);
        headers.setContentType(MediaType.APPLICATION_JSON);
        
        HttpEntity<Void> entity = new HttpEntity<>(headers);
        
        ResponseEntity<UserResponse> response = restTemplate.exchange(
            kongBaseUrl + "/api/users",
            HttpMethod.GET,
            entity,
            UserResponse.class
        );
        
        return response.getBody();
    }
}

@Service
public class ApiService {
    
    private final WebClient webClient;
    
    public ApiService(WebClient.Builder webClientBuilder,
                      @Value("${kong.api.base-url}") String kongBaseUrl,
                      @Value("${kong.api.key}") String apiKey) {
        this.webClient = webClientBuilder
            .baseUrl(kongBaseUrl)
            .defaultHeader("apikey", apiKey)
            .build();
    }
    
    public Mono<UserResponse> getUsers() {
        return webClient.get()
            .uri("/api/users")
            .retrieve()
            .bodyToMono(UserResponse.class);
    }
}

# 使用 Keycloak 的 JWKS 端點驗證
curl -X POST http://localhost:8001/plugins \
  --data name=jwt \
  --data config.claims_to_verify=exp \
  --data config.key_claim_name=iss

# 取得 Keycloak 的 JWKS
curl https://keycloak.example.com/realms/myrealm/protocol/openid-connect/certs

# 在 Kong 建立 Consumer 與 JWT 憑證
curl -X POST http://localhost:8001/consumers \
  --data username=keycloak-realm

curl -X POST http://localhost:8001/consumers/keycloak-realm/jwt \
  --data algorithm=RS256 \
  --data key=https://keycloak.example.com/realms/myrealm \
  --data rsa_public_key="-----BEGIN PUBLIC KEY-----..."

curl -X POST http://localhost:8001/plugins \
  --data name=prometheus \
  --data config.per_consumer=true \
  --data config.status_code_metrics=true \
  --data config.latency_metrics=true

# prometheus.yml
scrape_configs:
  - job_name: 'kong'
    scrape_interval: 15s
    static_configs:
      - targets: ['kong:8001']
    metrics_path: /metrics

curl -X POST http://localhost:8001/plugins \
  --data name=http-log \
  --data config.http_endpoint=http://logstash:5044 \
  --data config.method=POST \
  --data config.content_type="application/json" \
  --data config.flush_timeout=2 \
  --data config.retry_count=3

# logstash.conf
input {
  http {
    port => 5044
    codec => json
  }
}

filter {
  mutate {
    add_field => { "[@metadata][index]" => "kong-logs" }
  }
  
  date {
    match => [ "started_at", "UNIX_MS" ]
    target => "@timestamp"
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "kong-logs-%{+YYYY.MM.dd}"
  }
}

# 啟用 OpenTelemetry Plugin
curl -X POST http://localhost:8001/plugins \
  --data name=opentelemetry \
  --data config.endpoint=http://otel-collector:4318/v1/traces \
  --data config.resource_attributes.service.name=kong-gateway \
  --data config.headers.Authorization="Bearer xxx"

# 安裝 decK
brew install kong/deck/deck  # macOS
# 或下載 binary

# 匯出當前設定
deck dump -o kong.yaml

# 比較差異
deck diff -s kong.yaml

# 同步設定
deck sync -s kong.yaml

# 驗證設定檔
deck validate -s kong.yaml

# 不同環境使用不同設定檔
deck sync -s kong-dev.yaml --kong-addr http://kong-dev:8001
deck sync -s kong-uat.yaml --kong-addr http://kong-uat:8001
deck sync -s kong-prod.yaml --kong-addr http://kong-prod:8001

# nginx.conf 關鍵參數
worker_processes auto;
worker_connections 16384;

# Kong 環境變數
KONG_NGINX_WORKER_PROCESSES=auto
KONG_NGINX_PROXY_PROXY_BUFFER_SIZE=160k
KONG_NGINX_PROXY_PROXY_BUFFERS=64 160k

# 常用排查指令
# 查看 Kong 錯誤日誌
docker logs kong 2>&1 | grep -i error

# 檢查 Upstream 健康狀態
curl -s http://localhost:8001/upstreams/user-upstream/health | jq

# 檢查 Plugin 執行狀態
curl -s http://localhost:8001/plugins | jq '.data[] | {name, enabled}'

# 檢查已啟用的 Plugin
curl -s http://localhost:8001/plugins | jq '.data[].name' | sort | uniq

## Kong 升級前檢查清單

### 準備階段
- [ ] 確認當前版本：`curl localhost:8001 | jq '.version'`
- [ ] 閱讀目標版本 Release Notes
- [ ] 確認 PostgreSQL 版本相容性
- [ ] 確認所有 Plugin 相容性
- [ ] 備份設定：`deck dump -o backup-$(date +%Y%m%d).yaml`
- [ ] 備份資料庫：`pg_dump kong > kong_backup_$(date +%Y%m%d).sql`

### 測試階段
- [ ] 在測試環境執行升級
- [ ] 執行功能測試
- [ ] 執行效能測試
- [ ] 驗證所有 Plugin 正常運作

### 執行階段
- [ ] 通知相關團隊
- [ ] 準備 Rollback 計畫
- [ ] 執行滾動升級
- [ ] 監控錯誤率與延遲

### 驗證階段
- [ ] 確認所有節點版本一致
- [ ] 確認健康檢查正常
- [ ] 確認 Metrics 收集正常
- [ ] 確認日誌無異常

# 1. 執行 Migration（僅需執行一次）
docker run --rm kong:3.9 kong migrations up

# 2. 執行 Migration finish（如有）
docker run --rm kong:3.9 kong migrations finish

# 3. 滾動重啟各節點
kubectl rollout restart deployment/kong -n kong

# kong-production.yaml
_format_version: "3.0"

services:
  - name: user-service
    url: http://user-upstream
    connect_timeout: 5000
    write_timeout: 60000
    read_timeout: 60000
    retries: 3
    routes:
      - name: user-route
        paths:
          - /api/users
        strip_path: true
        preserve_host: false
    plugins:
      - name: rate-limiting
        config:
          minute: 100
          policy: redis
          redis_host: redis
          redis_port: 6379
      - name: jwt
        config:
          claims_to_verify:
            - exp
      - name: correlation-id
        config:
          header_name: X-Request-ID
          generator: uuid#counter

upstreams:
  - name: user-upstream
    algorithm: round-robin
    healthchecks:
      active:
        http_path: /actuator/health
        healthy:
          interval: 5
          successes: 2
        unhealthy:
          interval: 5
          http_failures: 3
    targets:
      - target: user-service-1:8080
        weight: 100
      - target: user-service-2:8080
        weight: 100

plugins:
  - name: prometheus
    config:
      per_consumer: true
      status_code_metrics: true
      latency_metrics: true
  - name: http-log
    config:
      http_endpoint: http://logstash:5044
      method: POST
      content_type: application/json
      flush_timeout: 2

## 新服務上線到 Kong 檢查清單

### 前置準備
- [ ] 後端服務已部署並可存取
- [ ] 後端服務有健康檢查端點
- [ ] 已確認 API 規格（Path、Method、認證方式）
- [ ] 已確認限流需求

### Kong 設定
- [ ] 建立 Service（設定正確的 URL/Upstream）
- [ ] 建立 Route（設定正確的 Path、Host、Method）
- [ ] 設定 Health Check（如使用 Upstream）
- [ ] 設定認證 Plugin（Key Auth / JWT）
- [ ] 設定 Rate Limiting
- [ ] 設定 CORS（如需要）
- [ ] 設定 Logging

### 測試驗證
- [ ] 測試正常請求是否成功
- [ ] 測試認證失敗情況
- [ ] 測試限流觸發情況
- [ ] 測試後端服務不可用情況
- [ ] 確認 Metrics 有收集到
- [ ] 確認 Log 有輸出

### 文件更新
- [ ] 更新 API 文件
- [ ] 更新 kong.yaml 設定檔
- [ ] 通知相關團隊

## Kong 日常維運檢查清單

### 每日檢查
- [ ] 檢查 Kong 節點健康狀態
- [ ] 檢查 5xx 錯誤率
- [ ] 檢查 P99 延遲
- [ ] 檢查 Upstream 健康狀態

### 每週檢查
- [ ] 檢查磁碟空間（Log）
- [ ] 檢查 Rate Limiting 觸發統計
- [ ] 檢查 Consumer 使用狀況
- [ ] 備份設定：`deck dump`

### 每月檢查
- [ ] 檢查是否有新版本
- [ ] 檢視 Plugin 使用狀況
- [ ] 檢視安全性公告
- [ ] 容量規劃檢討

## Kong 升級前檢查清單

### 準備階段
- [ ] 確認當前版本
- [ ] 閱讀目標版本 Release Notes
- [ ] 確認 Breaking Changes
- [ ] 確認 PostgreSQL 版本相容性
- [ ] 確認所有 Plugin 相容性
- [ ] 備份設定：`deck dump -o backup.yaml`
- [ ] 備份資料庫

### 測試階段
- [ ] 在測試環境升級
- [ ] 執行功能測試
- [ ] 執行效能測試
- [ ] 驗證所有 Plugin 正常

### 執行階段
- [ ] 選擇低峰時段
- [ ] 通知相關團隊
- [ ] 準備 Rollback 計畫
- [ ] 執行滾動升級
- [ ] 監控錯誤率與延遲

### 驗證階段
- [ ] 確認所有節點版本一致
- [ ] 確認健康檢查正常
- [ ] 確認 Metrics 正常
- [ ] 確認 Log 無異常
- [ ] 執行 Smoke Test

## Kong 安全性檢查清單

### 網路安全
- [ ] Admin API 限制內網存取
- [ ] Proxy 使用 HTTPS
- [ ] 設定 TLS 1.2+
- [ ] 關閉不必要的端口

### 認證授權
- [ ] 所有 API 都有認證
- [ ] 使用強密碼/複雜 Key
- [ ] JWT 使用 RS256
- [ ] 設定 Token 過期時間

### 存取控制
- [ ] 設定合理的 Rate Limiting
- [ ] 設定 ACL 權限
- [ ] 限制 CORS Origin

### 日誌與監控
- [ ] 啟用存取日誌
- [ ] 啟用錯誤日誌
- [ ] 設定異常告警
- [ ] 定期檢視安全日誌

# ===== 查詢指令 =====
# 查詢 Kong 版本
curl -s localhost:8001 | jq '.version'

# 查詢所有 Services
curl -s localhost:8001/services | jq

# 查詢所有 Routes
curl -s localhost:8001/routes | jq

# 查詢所有 Plugins
curl -s localhost:8001/plugins | jq

# 查詢所有 Consumers
curl -s localhost:8001/consumers | jq

# 查詢 Upstream 健康狀態
curl -s localhost:8001/upstreams/{upstream}/health | jq

# 查詢 Kong 狀態
curl -s localhost:8001/status | jq

# ===== 建立指令 =====
# 建立 Service
curl -X POST localhost:8001/services \
  --data name=my-service \
  --data url=http://backend:8080

# 建立 Route
curl -X POST localhost:8001/services/my-service/routes \
  --data name=my-route \
  --data "paths[]=/api"

# 建立 Consumer
curl -X POST localhost:8001/consumers \
  --data username=my-consumer

# 啟用 Plugin
curl -X POST localhost:8001/services/my-service/plugins \
  --data name=rate-limiting \
  --data config.minute=100

# ===== 刪除指令 =====
# 刪除 Service
curl -X DELETE localhost:8001/services/my-service

# 刪除 Route
curl -X DELETE localhost:8001/routes/my-route

# 刪除 Plugin
curl -X DELETE localhost:8001/plugins/{plugin-id}

# ===== decK 指令 =====
# 匯出設定
deck dump -o kong.yaml

# 比較差異
deck diff -s kong.yaml

# 同步設定
deck sync -s kong.yaml

# 驗證設定
deck validate -s kong.yaml