Kong Gateway Consulting & Support

Kong Consulting & Services for Enterprises

AceMQ engineers deploy and operate Kong Gateway in front of production APIs — DB-backed and DB-less, on VMs and on Kubernetes. We design plugin chains that hold under load and migrate teams off gateways that have become too expensive to keep.

A senior engineer, not an SDR. No sales sequence attached.

Senior SMEs
11+
Emergency SLA
<15min
Customers
160+
Countries Served
26+

Without moving your APIs onto a different gatewayFor production incident cover, see AceMQ Kong 24/7 support.

Customers

  • Microsoft
  • Henry Schein
  • Enbridge
  • Gojek

Partners

  • Broadcom
  • Redis
  • VMware Tanzu
  • OSSeva

The Problem

Why teams call us about Kong

Eight Kong problems that teams bring to AceMQ, from plugins that run on every route and rate limits that multiply with node count to health checks that eject healthy targets. They cover DB-backed, DB-less and hybrid deployments. If one describes your week, that is where the review starts.

  1. 01

    Plugin ordering was never made explicit and the same request behaves differently across routes

  2. 02

    Rate-limit counters are held per node, so the effective limit is multiplied by the node count

  3. 03

    The database-backed control plane is a single point of failure and DB-less was never evaluated

  4. 04

    Upstream health checks mark healthy targets down under load and traffic oscillates between them

  5. 05

    Custom Lua plugins were written by one engineer and nobody else will touch them

  6. 06

    Consumer and credential objects have accumulated and no one knows which are still in use

  7. 07

    The ingress controller configuration and the admin API configuration have quietly drifted apart

  8. 08

    Enterprise plugin entitlement costs more than the handful of features actually in use

A good fit if you run Kong Gateway in front of business-critical APIs and want senior engineers who know its plugin, routing and clustering failure modes, whether you plan to stay on Kong or move gateways.

Not a fit for small teams with non-critical workloads. AceMQ is not a budget consultancy: we work with enterprises running business-critical and compliance-heavy Kong.

Running Kong in production? Get a quote from a senior engineer, answered within one hour.

Contact Us

How it breaks, and the fix

What happens when one Kong plugin is applied to every route?

A Kong rate-limiting plugin configured globally and limiting by consumer keeps one counter for that consumer across every route. When a client bursts on one API, it spends the allowance for all of them, and healthy APIs start returning 429.

One global plugin, one shared counter

Clients, one Kong Gateway, three upstream APIs

Illustrative
  1. All three APIs answer. The consumer's shared rate-limit counter sits well under its limit, so no route is throttled.

  2. A client bursts on search-api. The plugin is global, so one counter covers every route, and orders-api and payments-api start returning 429 to that client although neither API changed.

  3. The plugin is attached per route, each with its own limit. Search-api is throttled on its own and orders-api and payments-api keep their allowance.

Throttling that lands on the wrong routes is a plugin-scope problem, not a capacity problem. The fix is configuration: attach rate limiting to the route or service instead of globally, pick a limit per route from what each upstream can absorb, and use the redis policy so the limit holds across nodes. The local policy counts per node, so an eight-node cluster enforces roughly eight times the limit. AceMQ reviews plugin scope, order and counter policy together.

Our Services

Kong Consulting & Services

AceMQ runs four Kong service lines: gateway architecture, plugin and performance tuning, migration from other gateways to Kong, and managed operations including Kong Ingress Controller. A senior engineer leads each one, and any of them can roll into 24/7 support with a 15-minute emergency SLA.

  • 01

    Kong Gateway Architecture & Implementation

    The DB-backed versus DB-less decision shapes your deployment model, your config workflow, and your failure behavior. We make that call deliberately and build the control plane topology around it.

    • DB-backed versus DB-less declarative configuration, with the operational tradeoffs stated up front
    • Control plane and data plane split for hybrid mode, including certificate rotation and node bootstrap
    • Route, service, and consumer modeling that survives team growth without a flat namespace collapse
    • decK-driven GitOps workflow so gateway configuration is reviewed and versioned like application code
  • 02

    Plugin Strategy & Performance Tuning

    Every plugin runs in the request path. Ordering, shared state, and rate limiter backend choice decide whether the gateway adds a millisecond or becomes the bottleneck itself.

    • Authentication design across OIDC, JWT, key-auth, and mTLS with consumer and credential modeling
    • Rate limiting strategy: local versus cluster versus Redis counters, and the accuracy-latency tradeoff of each
    • Plugin execution order and scoping so global plugins do not silently run on every internal route
    • Upstream health checks, retry, and timeout tuning plus worker process and connection pool sizing
  • 03

    API Gateway Migration to Kong

    Gateway migrations fail on policy parity and consumer credentials, not on routing. We map both before moving a single route and run the old and new gateways side by side.

    • Apigee, MuleSoft, WSO2, or legacy gateway migration with policy-by-policy mapping to Kong plugins
    • Consumer, credential, and API key migration without forcing every client to re-onboard at once
    • Custom policy translation into Kong plugins, including Lua or Go plugin development where no equivalent exists
    • Weighted traffic shifting per route with a rollback path that does not require a redeploy
  • 04

    Managed Kong Operations

    Ongoing operational coverage for gateways carrying production API traffic — including Kong Ingress Controller on Kubernetes, where gateway config and cluster state have to stay in agreement.

    • Kong Ingress Controller deployment and Gateway API resource management on Kubernetes
    • 24/7 monitoring of upstream health, latency percentiles, 5xx rates, and data plane node status
    • Version upgrade planning across Kong Gateway releases with plugin compatibility verification
    • Named engineer on your account with a 15-minute emergency response SLA
  • 05

    Kong Health Check & Assessment

    A structured review of routing, plugins, and security posture — including an honest read on whether Kong Gateway Enterprise features are earning their license cost for you.

    • Route and service configuration audit for shadowed routes, overly broad paths, and orphaned entities
    • Plugin inventory and execution order review with latency attribution per plugin
    • Security review: authentication coverage per route, admin API exposure, TLS and certificate handling
    • Kong OSS versus Enterprise assessment based on which paid features you actually use, plus a written remediation report
  • 15 MIN SLA

    24/7 Kong Support

    Named senior engineers on your account — 15-minute emergency response, no ticket routing, no junior triage.

    • 15-minute emergency response SLA
    • Named engineer, zero cold-start
    • Proactive CVE & health monitoring
    • Quarterly deployment reviews

Want AceMQ to take this off your team's plate? Tell us about your Kong estate.

Contact Us

24/7 Support

Kong Support When It Matters Most

AceMQ Kong support gives you named senior engineers and a 15-minute first response when the gateway returns errors in production, 24/7. Lower severities get 1-hour, 4-hour and next-day responses. The same tiers apply to OSS, Enterprise and Konnect data planes.

  1. 15 minfirst responseEmergencyProduction down, messages not flowing, queue manager failure
  2. 1 hourfirst responseCriticalSevere degradation, high error rates, approaching capacity
  3. 4 hoursfirst responseHighPerformance issues, configuration problems, non-critical failures
  4. Next Dayfirst responseStandardQuestions, guidance, best practices, non-urgent improvements

P1 escalation path

A replay of one P1, from the first page to the written root-cause analysis

SLA 15:00
T+Elapsed15:00
Engineer on your bridge

15-minute P1 response, 24/7.
A response time, not a resolution time.

  1. T+00:00

    P1 opened, on-call engineer paged

    Phone, email or Slack reaches the on-call senior engineer directly, whether the incident is in RabbitMQ, Kafka, Redis, PostgreSQL or Kubernetes. No web form, no tier-1 queue.

    Paged
  2. T+15:00

    Senior engineer on your bridge

    A senior engineer who already knows your environment joins a live bridge, so nobody has to re-explain your topology.

    Live
  3. T+30:00

    Specialists across the stack join

    When an incident crosses components, the engineers who know each one join. For RabbitMQ, the path runs to the core team.

    If needed
  4. After

    Written root-cause analysis

    Root cause, the fix applied and the prevention steps, delivered after every P1.

    Every P1

How Our Support Actually Works

Beyond SLAs — the model behind senior-only, zero-cold-start expert access.

  • Named Engineers on Your Account

    Every ticket is handled by a senior SME assigned to your account — not a pool of anonymous agents. Zero cold-start. No re-explaining your environment.

  • Live Escalation on Any Ticket

    Any ticket can be escalated to a live session with your named engineer via calendar booking. No gatekeeping, no approval required — direct access, always.

  • Proactive Risk Mitigation

    Quarterly health checks on your deployment plus shared intelligence from 50+ support customers — we surface risks before they reach production.

  • Critical Bug & CVE Intelligence

    Proactive alerts on critical bugs and CVEs affecting your exact version, with version compliance monitoring so you're never caught off guard.

  • Commercial EOL Versions

    Commercial support for end-of-life Kong versions, with security fixes backported through OSSeva, so the upgrade happens on your schedule rather than the community's.

How It Works

What actually happens next

An AceMQ Kong engagement runs in four stages: a gateway assessment of 1 to 2 weeks, written findings within a week, changes made with your engineers route by route, then a handover with runbooks. Each stage ends in writing, so your team sees what changes and why before anything does.

1–2 weeks

Gateway assessment

We review service and route layout, plugin chains and their ordering, rate-limiting strategy, upstream health checks, the DB-backed or DB-less deployment model and any custom Lua in the path.

Within a week

Written findings and plan

Prioritised findings with the reasoning attached, including which enterprise plugins are genuinely load-bearing and which are replaceable.

Scoped per engagement

Implementation alongside your team

We restructure plugin chains, rate-limiting and upstream configuration with your engineers rather than around them, route by route with rollback at each step.

Ongoing

Handover and optional cover

Runbooks for node replacement, plugin changes and upstream failure behaviour, plus 24/7 support with a 15-minute emergency SLA if you want it.

  • Written findings before any change
  • Every change staged route by route and reversible
  • Your engineers in the room
  • You keep the runbooks
  • Ad hoc engagements or an annual partnership

A senior engineer, not an SDR. No sales sequence attached.

Customer Success

Real Kong Results

Kong work from AceMQ, each card linking to the full write-up: the gateway estate, what AceMQ assessed or changed, and the result. Several come from neighbouring API gateways such as Apigee, because migrations and policy mapping run through Kong too.

1 / 6 case studies

All use cases

Solutions

Every way AceMQ works with Kong.

AceMQ covers Kong end to end: gateway consulting and migrations, 24/7 support and incident management, proactive monitoring, managed gateways on your infrastructure or on AceMQ's, support for Kong versions that have left Kong's policy, and a fixed-price health check.

Projects

Build, fix or move Kong

Fixed-scope work led by a senior engineer: architecture and new builds, a health check of what you run today, or a migration with a reversible cutover.

Side by side

Kong Gateway OSS, Enterprise or Konnect: what changes for support?

Kong Gateway comes as an open-source edition, a licensed Enterprise edition and Konnect, where Kong hosts the control plane and you run the data planes. Kong's support policy applies to Enterprise, and AceMQ covers all three. Each row below answers one question about the choice.

Kong Gateway OSS compared with Enterprise and Konnect on product support, version periods, management layer, plugins and what AceMQ covers
QuestionKong Gateway OSSKong Gateway EnterpriseKonnect
Who supports the product itself?The open-source community. Kong sets no support period for it.Kong, under its version support policy, through a subscription.Kong, for the hosted control plane. Data plane gateways run in your infrastructure.
How long is a version supported?No support period from Kong, so you set your own upgrade cadence.1 year per minor version, 3 years for LTS (3.10 and 3.14), then up to 12 months of sunset help.Data plane gateways need to stay on a supported Enterprise version.
Who runs the management layer?You do, through the Admin API, decK or the Ingress Controller.You do, with Kong Manager, RBAC and the developer portal available.Kong hosts the control plane, service catalog and developer portal.
Which plugins can you use?The bundled plugins, such as key-auth, JWT, OAuth2 and rate-limiting.Adds Enterprise plugins such as OpenID Connect and rate-limiting-advanced.The Enterprise plugin set, configured through the control plane.
What does AceMQ cover?Any version, including releases the community has moved past.Any version, including releases in sunset, alongside your Kong subscription.The data plane gateways, their plugins, decK pipelines and the platform underneath.
What usually decides the move?Staying works while the plugin set and a self-run upgrade cycle are enough.RBAC, the portal, Enterprise plugins or vendor support justify the licence.Wanting Kong to run the control plane while the data stays in your network.

For who supports which Kong version and when, read Kong support options compared. To see how Kong's windows sit beside 20 other technologies, see open source and vendor support windows compared.

Not sure which option fits? A senior Kong engineer will scope it with you.

Contact Us

One partner, not five

We Support Your Entire Tech Stack

Kong rarely fails in isolation. AceMQ covers the full surrounding infrastructure — so one team owns the whole path instead of pointing at each other.

See all 51 technologies we supportShow fewer

FAQs

Kong Questions Answered

Eight answers on Kong from AceMQ: supported and LTS versions, DB-less or DB-backed, who answers when the gateway fails, how an engagement starts, working with your platform team, 502s from healthy upstreams, rate limits that do not hold, and OSS versus Enterprise.

Still have questions about Kong? Email an Expert

Which Kong Gateway versions are supported, and does Kong have LTS?

Kong supports each Enterprise minor version for one year and each LTS version for three, with up to 12 months of sunset help afterwards. 3.10 and 3.14 are the current LTS lines. The open-source edition has no support period from Kong. AceMQ covers both editions on any version and plans the upgrade to a supported line.

Should we run Kong DB-backed or DB-less?

DB-less suits teams that deploy through CI and review configuration like code: there is no database to run, and data planes start from known state. DB-backed suits runtime changes through the Admin API and plugins that need the datastore. For most Kubernetes estates AceMQ recommends declarative configuration with decK or the Ingress Controller, and hybrid mode for large multi-region estates.

Who answers when Kong returns errors in production, and how fast?

A named AceMQ senior engineer answers within 15 minutes, 24/7, when Kong is failing in production. Lower severities get a first response within 1 hour, 4 hours or the next business day. The engineer who takes the first call stays on the case, and every P1 ends with a written root-cause analysis.

How does a Kong consulting engagement with AceMQ start?

A Kong engagement starts with a free consultation with a senior engineer, booked in our reply within 1 hour. A gateway assessment of 1 to 2 weeks follows, covering services, routes, plugin chains, rate limiting, health checks and the deployment model. Written findings and a plan arrive within a week, before anything changes.

Can an AceMQ engineer work alongside our platform team?

Yes. AceMQ assigns a named senior engineer who works with your platform and API teams, changing plugin chains, upstream settings and decK pipelines together with them. Changes are staged route by route with a rollback at each step, and you keep the runbooks for node replacement and plugin changes.

Why does Kong return 502 when the upstream is healthy?

The usual cause is DNS caching: Kong caches resolved addresses for the record TTL, so when pod IPs rotate faster than that, it keeps dialling addresses that no longer exist. The second cause is passive-only health checks, which never re-probe an ejected target. Both are configuration fixes, not capacity problems.

Why is our Kong rate limit not enforced?

Most often the plugin policy or scope is wrong. The local policy counts per node, so an eight-node cluster enforces about eight times the limit. A plugin configured globally shares one counter across every route for each consumer. Moving to the redis policy and attaching the plugin per route fixes both.

Do we need Kong Gateway Enterprise, or is open source enough?

It depends on which Enterprise features you use. If you need RBAC, the developer portal, Enterprise plugins such as OpenID Connect, or Kong's vendor support, the licence buys something real. If you pay for it and use open-source functionality, AceMQ will say so. The health check includes a feature-by-feature read.

Can we work with AceMQ on Kong without a long contract?

Yes. AceMQ works on Kong in two ways: ad hoc engagements for a defined piece of work, such as a health check, an upgrade or an incident, or an annual partner engagement that covers 24/7 support, proactive reviews and named engineers. Many teams start ad hoc and move to an annual partnership once the first engagement is done.

How much does AceMQ Kong support or consulting cost?

Every AceMQ proposal is tailored to your requirements: your Kong environment, the SLA you need, the hours of cover and the scope of work. Most contracts run $24,000–72,000 a year, depending on the SLA, the scope and how Kong is deployed, with aggressive discounts when several technologies share one contract. Request a quote and AceMQ replies within 1 hour.

Let's talk

Ready to Get Your API Gateway Under Control?

Whether you need architecture review, a plugin and performance pass, a migration partner, or ongoing managed operations — AceMQ staffs every engagement with a named senior engineer. Quote requests answered within 1 hour.

A senior Kong engineer, not a sales queueAbout your gateway, not a pitch deckQuote requests answered within 1 hour

Production incident right now?Email a Kong Architect

Get in Touch

Talk to a Kong Expert

Send us a message and we'll follow up within 1 hour — or book a free 30-min consultation directly.

305-204-2607
info@acemq.com
66 W. Flagler St. 9th Floor
Miami, FL 33130

Prefer to talk now? Call us directly or use the consultation tab to find a time that works.

We respond within 1 hour.

Pick a time that works — no pressure, no pitch. Just 30 minutes with an expert.

We respond within 1 hour.