zuplo 7.3.2 → 7.4.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/ai-gateway/apps.mdx +2 -2
- package/docs/ai-gateway/custom-policies.mdx +3 -3
- package/docs/ai-gateway/fallback.mdx +13 -12
- package/docs/ai-gateway/getting-started.mdx +10 -9
- package/docs/ai-gateway/introduction.mdx +19 -18
- package/docs/ai-gateway/managing-apps.mdx +9 -7
- package/docs/ai-gateway/policy-chains.mdx +13 -7
- package/docs/ai-gateway/policy-templates.mdx +4 -3
- package/docs/ai-gateway/usage-limits.mdx +8 -10
- package/docs/api-management/introduction.md +1 -1
- package/docs/articles/api-key-api.mdx +3 -3
- package/docs/articles/custom-ci-cd-azure.mdx +1 -1
- package/docs/articles/custom-ci-cd-bitbucket.mdx +2 -2
- package/docs/articles/custom-code-patterns.md +1 -1
- package/docs/articles/custom-domains.mdx +2 -2
- package/docs/articles/development-options.mdx +4 -4
- package/docs/articles/fastly-zuplo-host-setup.mdx +5 -5
- package/docs/articles/feature-flags.mdx +442 -0
- package/docs/articles/gke-with-upstream-auth-policy.mdx +7 -7
- package/docs/articles/health-checks.mdx +4 -4
- package/docs/articles/hosting-options.mdx +2 -2
- package/docs/articles/local-development-env-variables.mdx +1 -1
- package/docs/articles/metrics-plugins.mdx +1 -1
- package/docs/articles/migration-overview.md +1 -1
- package/docs/articles/monorepo-deployment.mdx +10 -10
- package/docs/articles/performance-testing.mdx +10 -9
- package/docs/articles/plugin-azure-blob.mdx +1 -1
- package/docs/articles/plugin-azure-event-hubs.mdx +2 -2
- package/docs/articles/policies.mdx +2 -2
- package/docs/articles/securing-backend-mtls.mdx +3 -3
- package/docs/articles/securing-the-gateway-with-client-mtls.mdx +3 -3
- package/docs/articles/securing-your-backend.mdx +1 -1
- package/docs/articles/security.mdx +1 -1
- package/docs/articles/terraform.mdx +2 -2
- package/docs/articles/testing.mdx +6 -6
- package/docs/articles/troubleshooting-slow-responses.mdx +5 -6
- package/docs/articles/troubleshooting.md +1 -1
- package/docs/articles/use-openapi-extension-data.mdx +4 -4
- package/docs/articles/waf-ddos-akamai.md +13 -13
- package/docs/articles/waf-ddos-aws-waf-shield.mdx +14 -14
- package/docs/articles/waf-ddos-fastly.mdx +14 -14
- package/docs/articles/waf-ddos.mdx +7 -7
- package/docs/cli/authentication.mdx +1 -1
- package/docs/cli/lint.mdx +103 -0
- package/docs/concepts/how-zuplo-works.mdx +5 -4
- package/docs/concepts/upstream-credentials.mdx +1 -1
- package/docs/dedicated/akamai/architecture.mdx +23 -24
- package/docs/dedicated/akamai/cdn.mdx +20 -20
- package/docs/dedicated/architecture.mdx +28 -27
- package/docs/dedicated/custom-domains.mdx +3 -4
- package/docs/dedicated/federated-gateways.mdx +1 -1
- package/docs/dedicated/networking.mdx +10 -10
- package/docs/dedicated/overview.mdx +3 -3
- package/docs/dedicated/source-control.mdx +6 -5
- package/docs/handlers/custom-handler.mdx +4 -4
- package/docs/handlers/mcp-server.mdx +1 -1
- package/docs/handlers/url-forward.mdx +1 -2
- package/docs/mcp-server/introduction.mdx +4 -4
- package/docs/policies/_index.md +2 -2
- package/docs/policies/ai-gateway-configuration-executor-v2-inbound/schema.json +1 -1
- package/docs/policies/ai-gateway-dlp-inbound/doc.md +79 -45
- package/docs/policies/ai-gateway-dlp-inbound/schema.json +5679 -3359
- package/docs/policies/ai-gateway-metering-v2-inbound/doc.md +13 -13
- package/docs/policies/ai-gateway-metering-v2-inbound/schema.json +1 -1
- package/docs/programmable-api/environment.mdx +1 -1
- package/docs/programmable-api/jwt-service-plugin.mdx +1 -1
- package/docs/programmable-api/logger.mdx +1 -1
- package/docs/programmable-api/runtime-errors.mdx +1 -1
- package/docs/programmable-api/zuplo-context.mdx +3 -3
- package/docs/self-hosted/overview.md +3 -3
- package/package.json +5 -5
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
title: Akamai Dedicated Architecture
|
|
3
3
|
sidebar_label: Architecture
|
|
4
4
|
description:
|
|
5
|
-
Architecture overview for Zuplo
|
|
6
|
-
Cloud.
|
|
5
|
+
Architecture overview for Zuplo Gateway deployments on Akamai Connected Cloud.
|
|
7
6
|
---
|
|
8
7
|
|
|
9
8
|
Zuplo integrates with Akamai Connected Cloud to provide a secure, highly
|
|
@@ -20,11 +19,11 @@ components:
|
|
|
20
19
|
handles incoming client requests, providing caching, DDoS protection, and
|
|
21
20
|
edge security.
|
|
22
21
|
2. **Akamai Global Traffic Manager (GTM)** - Routes traffic to the appropriate
|
|
23
|
-
Zuplo
|
|
24
|
-
|
|
25
|
-
3. **Zuplo
|
|
26
|
-
|
|
27
|
-
|
|
22
|
+
Zuplo Gateway instances based on geographic location, health status, and load
|
|
23
|
+
balancing policies.
|
|
24
|
+
3. **Zuplo Gateway** - Deployed on Akamai Connected Cloud, the gateway handles
|
|
25
|
+
authentication, authorization, rate limiting, and request routing. Origin IP
|
|
26
|
+
ACL ensures only Akamai edge servers can reach the gateway.
|
|
28
27
|
4. **Backend Services** - Your origin servers can be hosted on Akamai compute,
|
|
29
28
|
customer VPCs, on-premise data centers, or public cloud providers.
|
|
30
29
|
|
|
@@ -48,7 +47,7 @@ to Zuplo and your backend services:
|
|
|
48
47
|
</DiagramGroup>
|
|
49
48
|
<DiagramGroup id="akamai-cloud" label="Akamai Connected Cloud">
|
|
50
49
|
<DiagramNode id="gateway" variant="zuplo">
|
|
51
|
-
Zuplo
|
|
50
|
+
Zuplo Gateway
|
|
52
51
|
</DiagramNode>
|
|
53
52
|
</DiagramGroup>
|
|
54
53
|
<DiagramGroup id="backends" label="Backend Services">
|
|
@@ -67,9 +66,9 @@ to Zuplo and your backend services:
|
|
|
67
66
|
2. **CDN to GTM** - The edge server forwards the request to Akamai Global
|
|
68
67
|
Traffic Manager, which determines the optimal Zuplo instance to handle the
|
|
69
68
|
request.
|
|
70
|
-
3. **GTM to Zuplo** - GTM routes the request to a Zuplo
|
|
71
|
-
|
|
72
|
-
4. **Zuplo to Backend** - The Zuplo
|
|
69
|
+
3. **GTM to Zuplo** - GTM routes the request to a Zuplo Gateway. Origin IP ACL
|
|
70
|
+
ensures only traffic from Akamai's edge network reaches the gateway.
|
|
71
|
+
4. **Zuplo to Backend** - The Zuplo Gateway processes the request (applying
|
|
73
72
|
policies, authentication, rate limiting) and forwards it to your backend
|
|
74
73
|
services.
|
|
75
74
|
|
|
@@ -94,7 +93,7 @@ providing seamless failover.
|
|
|
94
93
|
|
|
95
94
|
### Secure connectivity with Origin IP ACL
|
|
96
95
|
|
|
97
|
-
The connection between Akamai edge servers and Zuplo
|
|
96
|
+
The connection between Akamai edge servers and Zuplo Gateways uses
|
|
98
97
|
[Origin IP ACL](https://techdocs.akamai.com/origin-ip-acl/docs/welcome) to
|
|
99
98
|
restrict access to the gateway. Origin IP ACL ensures that only requests from
|
|
100
99
|
Akamai's edge network can reach your Zuplo origin. This provides:
|
|
@@ -112,9 +111,9 @@ connect to your gateway.
|
|
|
112
111
|
|
|
113
112
|
## Multi-region deployment
|
|
114
113
|
|
|
115
|
-
Deploy your Zuplo
|
|
116
|
-
|
|
117
|
-
|
|
114
|
+
Deploy your Zuplo Gateway to multiple regions on Akamai Connected Cloud for high
|
|
115
|
+
availability, lower latency, and disaster recovery. GTM intelligently routes
|
|
116
|
+
traffic to the closest healthy region.
|
|
118
117
|
|
|
119
118
|
<Diagram height="h-[500px]" direction="vertical">
|
|
120
119
|
<DiagramNode id="client">Client</DiagramNode>
|
|
@@ -128,7 +127,7 @@ routes traffic to the closest healthy region.
|
|
|
128
127
|
</DiagramGroup>
|
|
129
128
|
<DiagramGroup id="region1" label="Akamai Cloud - Region 1">
|
|
130
129
|
<DiagramNode id="gateway1" variant="zuplo">
|
|
131
|
-
Zuplo
|
|
130
|
+
Zuplo Gateway
|
|
132
131
|
</DiagramNode>
|
|
133
132
|
<DiagramNode id="backend1" variant="green">
|
|
134
133
|
Backend (Region 1)
|
|
@@ -136,7 +135,7 @@ routes traffic to the closest healthy region.
|
|
|
136
135
|
</DiagramGroup>
|
|
137
136
|
<DiagramGroup id="region2" label="Akamai Cloud - Region 2">
|
|
138
137
|
<DiagramNode id="gateway2" variant="zuplo">
|
|
139
|
-
Zuplo
|
|
138
|
+
Zuplo Gateway
|
|
140
139
|
</DiagramNode>
|
|
141
140
|
<DiagramNode id="backend2" variant="green">
|
|
142
141
|
Backend (Region 2)
|
|
@@ -144,7 +143,7 @@ routes traffic to the closest healthy region.
|
|
|
144
143
|
</DiagramGroup>
|
|
145
144
|
<DiagramGroup id="region3" label="Akamai Cloud - Region 3">
|
|
146
145
|
<DiagramNode id="gateway3" variant="zuplo">
|
|
147
|
-
Zuplo
|
|
146
|
+
Zuplo Gateway
|
|
148
147
|
</DiagramNode>
|
|
149
148
|
<DiagramNode id="backend3" variant="green">
|
|
150
149
|
Backend (Region 3)
|
|
@@ -181,15 +180,15 @@ Configure GTM properties with appropriate settings:
|
|
|
181
180
|
|
|
182
181
|
## Backend connectivity
|
|
183
182
|
|
|
184
|
-
Zuplo
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
183
|
+
Zuplo Gateway supports multiple methods for securing connections to your backend
|
|
184
|
+
services. Most authentication methods work regardless of where your backend is
|
|
185
|
+
hosted, giving you flexibility to choose the approach that best fits your
|
|
186
|
+
security requirements.
|
|
188
187
|
|
|
189
188
|
<Diagram height="h-[300px]" direction="vertical">
|
|
190
189
|
<DiagramGroup id="akamai-cloud" label="Akamai Connected Cloud">
|
|
191
190
|
<DiagramNode id="gateway" variant="zuplo">
|
|
192
|
-
Zuplo
|
|
191
|
+
Zuplo Gateway
|
|
193
192
|
</DiagramNode>
|
|
194
193
|
</DiagramGroup>
|
|
195
194
|
<DiagramGroup id="akamai-compute" label="Akamai Compute">
|
|
@@ -265,7 +264,7 @@ Consider these factors when selecting an authentication method:
|
|
|
265
264
|
For detailed instructions on configuring Akamai CDN properties for your Zuplo
|
|
266
265
|
deployment, see [Setting up Akamai CDNs](./cdn.mdx). This guide covers:
|
|
267
266
|
|
|
268
|
-
- Property hostname configuration for
|
|
267
|
+
- Property hostname configuration for Zuplo Gateway and developer portal
|
|
269
268
|
- Origin server settings with host header forwarding
|
|
270
269
|
- Origin IP ACL configuration for secure edge-to-origin connectivity
|
|
271
270
|
- Caching behaviors for API responses
|
|
@@ -9,7 +9,7 @@ When running managed dedicated on the Akamai Cloud, you need to set up 2 CDNs,
|
|
|
9
9
|
one for your API endpoint deployments, and one for your developer portal.
|
|
10
10
|
|
|
11
11
|
This document outlines the configurations you need to add to your Akamai CDNs to
|
|
12
|
-
set them up to access your
|
|
12
|
+
set them up to access your Zuplo Gateway and developer portal.
|
|
13
13
|
|
|
14
14
|
All configurations in this guide were done on the Akamai Property Manager, see
|
|
15
15
|
the
|
|
@@ -18,14 +18,14 @@ for more details.
|
|
|
18
18
|
|
|
19
19
|
### Domains
|
|
20
20
|
|
|
21
|
-
Before you configure the CDN for your
|
|
22
|
-
to decide how you would like your domains to be set up. Generally, you will
|
|
21
|
+
Before you configure the CDN for your Zuplo Gateway and Developer Portal, you
|
|
22
|
+
will to decide how you would like your domains to be set up. Generally, you will
|
|
23
23
|
provision two types of domains - a static domain for production and wildcard
|
|
24
24
|
domains for preview environments.
|
|
25
25
|
|
|
26
26
|
For preview environments, you will use wildcard domains so that each environment
|
|
27
27
|
(normally each git branch) will have its own subdomain. For example, you might
|
|
28
|
-
use `*.api.example.com` for the
|
|
28
|
+
use `*.api.example.com` for the Zuplo Gateway and `*.dev.example.com` for the
|
|
29
29
|
developer portal. This will allow you to have URLs for each environment like
|
|
30
30
|
`https://my-environment-123.api.example.com` and
|
|
31
31
|
`https://my-environment-123.dev.example.com`.
|
|
@@ -42,20 +42,20 @@ certificates will be different.
|
|
|
42
42
|
|
|
43
43
|
1. Provision the domains that you would like these CDNs to have and certificates
|
|
44
44
|
for those domains, according to the domain section.
|
|
45
|
-
2. Request the Origin URLs for your
|
|
45
|
+
2. Request the Origin URLs for your Zuplo Gateway and developer portal from your
|
|
46
46
|
Zuplo account manager.
|
|
47
47
|
3. Let your Zuplo account manager know what hostnames/domains you will be using
|
|
48
48
|
in your CDNs.
|
|
49
49
|
|
|
50
|
-
##
|
|
50
|
+
## Zuplo Gateway CDN
|
|
51
51
|
|
|
52
|
-
This section guides you on how to configure your
|
|
52
|
+
This section guides you on how to configure your Zuplo Gateway CDN.
|
|
53
53
|
|
|
54
|
-
Add the
|
|
55
|
-
Gateway CDN. See the Akamai docs on
|
|
54
|
+
Add the Zuplo Gateway domain you provisioned to the Property Hostname for the
|
|
55
|
+
Zuplo Gateway CDN. See the Akamai docs on
|
|
56
56
|
[configuring HTTPS host names](https://techdocs.akamai.com/property-mgr/docs/serve-content-over-https).
|
|
57
57
|
|
|
58
|
-
An example of how you might configure your
|
|
58
|
+
An example of how you might configure your Zuplo Gateway CDN domains for your
|
|
59
59
|
preview environment and your production environment is below. Note that for your
|
|
60
60
|
development environment CDN, you would need the wildcard domain since many
|
|
61
61
|
development environments are named things like
|
|
@@ -95,10 +95,10 @@ After configuring the CDN domains, make the following behavior changes:
|
|
|
95
95
|

|
|
96
96
|
|
|
97
97
|
2. Configure the Origin URL to point to the URL given to you by Zuplo for your
|
|
98
|
-
|
|
99
|
-
Value, and the value should be the variable you created in the
|
|
100
|
-
This would look something similar to below:
|
|
101
|
-

|
|
102
102
|
|
|
103
103
|
3. Turn on Content Targeting (Edgescape) in the Geolocation rule in the Property
|
|
104
104
|
Manager Sidebar.
|
|
@@ -111,10 +111,10 @@ After configuring the CDN domains, make the following behavior changes:
|
|
|
111
111
|
This section guides you on how to set up the Developer Portal CDN.
|
|
112
112
|
|
|
113
113
|
Add the Developer Portal gateway domain you provisioned to the Property Hostname
|
|
114
|
-
for the
|
|
114
|
+
for the Zuplo Gateway CDN. See the Akamai docs on
|
|
115
115
|
[configuring HTTPS host names](https://techdocs.akamai.com/property-mgr/docs/serve-content-over-https).
|
|
116
|
-
This is done similarly to your
|
|
117
|
-
the domains you provisioned for your Developer Portal.
|
|
116
|
+
This is done similarly to your Zuplo Gateway CDN hostname configuration, but
|
|
117
|
+
with the domains you provisioned for your Developer Portal.
|
|
118
118
|
|
|
119
119
|
An example of how you might configure your Developer Portal CDN domains for your
|
|
120
120
|
preview environment and your production environment is below.
|
|
@@ -128,7 +128,7 @@ Under the Default Rule page, add the following behaviors:
|
|
|
128
128
|
|
|
129
129
|
1. Configure the origin URL to be the URL given to be the one given to you by
|
|
130
130
|
Zuplo for your Developer Portal. This will look similarly to how you
|
|
131
|
-
configured it for your
|
|
131
|
+
configured it for your Zuplo Gateway CDN. Take note that the Forward Host
|
|
132
132
|
header should also be set as the Origin Hostname.
|
|
133
133
|
|
|
134
134
|
2. Modify Incoming Request Header behavior, with the following fields:
|
|
@@ -149,8 +149,8 @@ Under the Default Rule page, add the following behaviors:
|
|
|
149
149
|
|
|
150
150
|

|
|
151
151
|
|
|
152
|
-
Congratulations, you've set up your Akamai CDN to serve your
|
|
152
|
+
Congratulations, you've set up your Akamai CDN to serve your Zuplo Gateway and
|
|
153
153
|
Developer Portal! At this point, you should be able to test that these things
|
|
154
|
-
are working by either hitting an endpoint in your
|
|
154
|
+
are working by either hitting an endpoint in your Zuplo Gateway (e.g.,
|
|
155
155
|
mygateway.com/my/endpoint), or navigating to a page in your developer portal
|
|
156
156
|
(e.g., myportal.com/home).
|
|
@@ -4,27 +4,27 @@ sidebar_label: Architecture
|
|
|
4
4
|
---
|
|
5
5
|
|
|
6
6
|
Zuplo's managed dedicated instances are highly available, scalable, and secure.
|
|
7
|
-
With a managed dedicated instance of Zuplo, your
|
|
7
|
+
With a managed dedicated instance of Zuplo, your Zuplo Gateway runs on isolated
|
|
8
8
|
instances and, when running on a cloud provider that supports it, a dedicated
|
|
9
9
|
network environment. This document outlines the components and architecture of a
|
|
10
|
-
managed dedicated instance of a Zuplo
|
|
10
|
+
managed dedicated instance of a Zuplo Gateway.
|
|
11
11
|
|
|
12
12
|
## Components
|
|
13
13
|
|
|
14
14
|
A managed dedicated instance of Zuplo consists of the following components:
|
|
15
15
|
|
|
16
|
-
- **
|
|
17
|
-
incoming requests, routes them to the appropriate backend, and
|
|
18
|
-
response to the client. The
|
|
19
|
-
rate limiting, and other features.
|
|
20
|
-
- **Gateway Services**: Zuplo, being a highly distributed
|
|
21
|
-
|
|
16
|
+
- **Zuplo Gateway**: The Zuplo Gateway is the core component of Zuplo. It
|
|
17
|
+
receives incoming requests, routes them to the appropriate backend, and
|
|
18
|
+
returns the response to the client. The gateway handles authentication,
|
|
19
|
+
authorization, rate limiting, and other features.
|
|
20
|
+
- **Gateway Services**: Zuplo, being a highly distributed gateway, uses services
|
|
21
|
+
to facilitate features such as
|
|
22
22
|
[Rate Limiting](../articles/step-2-add-rate-limiting.mdx) and
|
|
23
23
|
[API Key Authentication](../articles/api-key-management.mdx).
|
|
24
|
-
- **Control Plane**: The Control Plane manages the configuration of the
|
|
25
|
-
Gateway. It deploys new configurations, manages the lifecycle of the
|
|
24
|
+
- **Control Plane**: The Control Plane manages the configuration of the Zuplo
|
|
25
|
+
Gateway. It deploys new configurations, manages the lifecycle of the Zuplo
|
|
26
26
|
Gateway, and monitors its health.
|
|
27
|
-
- **Analytics and Logging**: Zuplo provides analytics and logging for your
|
|
27
|
+
- **Analytics and Logging**: Zuplo provides analytics and logging for your Zuplo
|
|
28
28
|
Gateway. This includes request/response logging, error logging, and analytics
|
|
29
29
|
on request volume, latency, and other metrics.
|
|
30
30
|
- **Developer Portal**: The Developer Portal is a web-based interface that
|
|
@@ -51,7 +51,7 @@ requirements. Examples include:
|
|
|
51
51
|
can disable the built-in analytics. When disabled, Zuplo stops collecting or
|
|
52
52
|
storing analytics data for the APIs.
|
|
53
53
|
- **Custom Logging & Monitoring** - Zuplo can integrate with your existing
|
|
54
|
-
logging and monitoring systems. Logs and other data go directly from the
|
|
54
|
+
logging and monitoring systems. Logs and other data go directly from the Zuplo
|
|
55
55
|
Gateway to your logging provider. Zuplo doesn't collect or store this data.
|
|
56
56
|
|
|
57
57
|
## Security
|
|
@@ -62,11 +62,12 @@ for you to customize the networking and connectivity to meet your specific
|
|
|
62
62
|
security requirements.
|
|
63
63
|
|
|
64
64
|
- **IAM Authorization**: Managed dedicated instances of Zuplo can use the IAM
|
|
65
|
-
capabilities to control traffic between the
|
|
65
|
+
capabilities to control traffic between the Zuplo Gateway and other services.
|
|
66
66
|
- **Encryption**: Zuplo encrypts data both in transit and at rest. TLS secures
|
|
67
|
-
all data sent to or from the
|
|
67
|
+
all data sent to or from the Zuplo Gateway. Zuplo encrypts stored data at
|
|
68
|
+
rest.
|
|
68
69
|
- **Access Control**: Zuplo provides robust authentication and access control
|
|
69
|
-
mechanisms. You control who has access to your
|
|
70
|
+
mechanisms. You control who has access to your Zuplo Gateway management
|
|
70
71
|
capabilities, what they can do, and what data they can access.
|
|
71
72
|
- **Audit Logs**: Zuplo provides detailed audit logs of all management
|
|
72
73
|
operations. You can see who did what, when they did it, and what data they
|
|
@@ -86,7 +87,7 @@ instance of Zuplo and how the components interact with each other.
|
|
|
86
87
|
<DiagramNode id="client">Client</DiagramNode>
|
|
87
88
|
<DiagramGroup id="dedicated-vpc" label="Dedicated Network">
|
|
88
89
|
<DiagramNode id="gateway" variant="zuplo">
|
|
89
|
-
Zuplo
|
|
90
|
+
Zuplo Gateway
|
|
90
91
|
</DiagramNode>
|
|
91
92
|
<DiagramNode id="services" variant="zuplo">
|
|
92
93
|
Gateway Services
|
|
@@ -108,7 +109,7 @@ instance of Zuplo and how the components interact with each other.
|
|
|
108
109
|
|
|
109
110
|
When you deploy to your managed dedicated instance of Zuplo, you upload your
|
|
110
111
|
source code and configuration files to the Control Plane. The Control Plane then
|
|
111
|
-
deploys your
|
|
112
|
+
deploys your Zuplo Gateway to the appropriate infrastructure. The Zuplo Gateway
|
|
112
113
|
deploys to multiple nodes in multiple regions to provide high availability and
|
|
113
114
|
low latency. If you run in multiple regions, the Control Plane manages the
|
|
114
115
|
deployment to each region without any downtime.
|
|
@@ -124,7 +125,7 @@ customized to meet your specific requirements.
|
|
|
124
125
|
Control Plane
|
|
125
126
|
</DiagramNode>
|
|
126
127
|
<DiagramNode id="gateway" variant="zuplo">
|
|
127
|
-
Zuplo
|
|
128
|
+
Zuplo Gateway
|
|
128
129
|
</DiagramNode>
|
|
129
130
|
<DiagramNode id="portal" variant="zuplo">
|
|
130
131
|
Dev Portal
|
|
@@ -136,12 +137,12 @@ customized to meet your specific requirements.
|
|
|
136
137
|
|
|
137
138
|
### Multiple regions
|
|
138
139
|
|
|
139
|
-
It's common practice to deploy your
|
|
140
|
+
It's common practice to deploy your Zuplo Gateway to multiple regions to provide
|
|
140
141
|
higher availability, lower latency, and meet regulatory requirements. Zuplo can
|
|
141
|
-
deploy your
|
|
142
|
+
deploy your Zuplo Gateway to multiple regions and manage the deployment to each
|
|
142
143
|
region without any downtime.
|
|
143
144
|
|
|
144
|
-
When you deploy your
|
|
145
|
+
When you deploy your Zuplo Gateway to multiple regions, Zuplo uses a global load
|
|
145
146
|
balancer to route traffic to the closest region. This provides low latency
|
|
146
147
|
access to your APIs for end-users around the world. The load balancer also
|
|
147
148
|
handles failover in case of an outage in one region.
|
|
@@ -150,13 +151,13 @@ handles failover in case of an outage in one region.
|
|
|
150
151
|
<DiagramNode id="client">Client</DiagramNode>
|
|
151
152
|
<DiagramNode id="lb">Load Balancer</DiagramNode>
|
|
152
153
|
<DiagramNode id="region1" variant="zuplo">
|
|
153
|
-
|
|
154
|
+
Zuplo Gateway (Region 1)
|
|
154
155
|
</DiagramNode>
|
|
155
156
|
<DiagramNode id="region2" variant="zuplo">
|
|
156
|
-
|
|
157
|
+
Zuplo Gateway (Region 2)
|
|
157
158
|
</DiagramNode>
|
|
158
159
|
<DiagramNode id="region3" variant="zuplo">
|
|
159
|
-
|
|
160
|
+
Zuplo Gateway (Region 3)
|
|
160
161
|
</DiagramNode>
|
|
161
162
|
<DiagramEdge from="client" to="lb" />
|
|
162
163
|
<DiagramEdge from="lb" to="region1" />
|
|
@@ -169,7 +170,7 @@ handles failover in case of an outage in one region.
|
|
|
169
170
|
Customers running managed dedicated Zuplo typically have multiple instances of
|
|
170
171
|
Zuplo deployed. The most common case is to have a production instance and a
|
|
171
172
|
non-production instance. The non-production instance is used to deploy and test
|
|
172
|
-
changes to your
|
|
173
|
+
changes to your Zuplo Gateway before deploying them to production. Each instance
|
|
173
174
|
can run many different deployments. A typical setup, the production instance
|
|
174
175
|
hosts only the production deployment, while the non-production instance hosts
|
|
175
176
|
many other deployments (for example staging, development, QA, or any feature
|
|
@@ -197,10 +198,10 @@ customizable.
|
|
|
197
198
|
Control Plane
|
|
198
199
|
</DiagramNode>
|
|
199
200
|
<DiagramNode id="prod" variant="zuplo">
|
|
200
|
-
|
|
201
|
+
Zuplo Gateway (Production)
|
|
201
202
|
</DiagramNode>
|
|
202
203
|
<DiagramNode id="non-prod" variant="zuplo">
|
|
203
|
-
|
|
204
|
+
Zuplo Gateway (Non-Production)
|
|
204
205
|
</DiagramNode>
|
|
205
206
|
<DiagramEdge from="source" to="control" label="Deploy" />
|
|
206
207
|
<DiagramEdge from="control" to="prod" />
|
|
@@ -6,10 +6,9 @@ sidebar_label: Custom Domains
|
|
|
6
6
|
Configuration of custom domains with your managed dedicated instance of Zuplo
|
|
7
7
|
varies depending on how your
|
|
8
8
|
[instance networking is configured](./networking.mdx). For customers using their
|
|
9
|
-
Zuplo
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
well.
|
|
9
|
+
Zuplo Gateway as the ingress the bulk of the configuration is managed by Zuplo.
|
|
10
|
+
You will be provided an IP address or CNAME to point your DNS to. Normally,
|
|
11
|
+
Zuplo manages the SSL certificates in this type of configuration as well.
|
|
13
12
|
|
|
14
13
|
Custom configurations are supported with Zuplo Managed Dedicated instances. For
|
|
15
14
|
example, you can use your own SSL certificates, or if you are using your own VPC
|
|
@@ -7,7 +7,7 @@ sidebar_label: Federated Gateways
|
|
|
7
7
|
|
|
8
8
|
With a managed dedicated Zuplo instance you can create a federated gateway that
|
|
9
9
|
allows you to connect multiple Zuplo projects together. This is useful for
|
|
10
|
-
creating a single
|
|
10
|
+
creating a single Zuplo Gateway that can route requests to multiple backend
|
|
11
11
|
services, each running on its own Zuplo instance.
|
|
12
12
|
|
|
13
13
|
## Reasons to Use Federated Gateways
|
|
@@ -12,9 +12,9 @@ Common configurations include:
|
|
|
12
12
|
- Using Zuplo as the public ingress to your API and using network connectivity
|
|
13
13
|
such as PrivateLink, Private Service Connect, VNet or VPC peering, or
|
|
14
14
|
provider-native network hubs to connect to your backend services.
|
|
15
|
-
- Restricting access to the public internet by configuring your
|
|
15
|
+
- Restricting access to the public internet by configuring your Zuplo Gateway to
|
|
16
16
|
only accept traffic from specific IP ranges or private networks, allowing you
|
|
17
|
-
to put WAFs, IDS/IPS, or other security appliances in front of your
|
|
17
|
+
to put WAFs, IDS/IPS, or other security appliances in front of your Zuplo
|
|
18
18
|
Gateway.
|
|
19
19
|
- Multiple dedicated managed instances of Zuplo can be deployed across multiple
|
|
20
20
|
regions to provide high availability and disaster recovery.
|
|
@@ -32,19 +32,19 @@ To discuss your networking requirements, please contact your account manager.
|
|
|
32
32
|
|
|
33
33
|
## Zuplo Ingress to Customer Private Network
|
|
34
34
|
|
|
35
|
-
The default setup for dedicated managed Zuplo is to use your Zuplo
|
|
36
|
-
|
|
37
|
-
|
|
35
|
+
The default setup for dedicated managed Zuplo is to use your Zuplo Gateway as
|
|
36
|
+
the public ingress to your API. This is the simplest setup and allows Zuplo to
|
|
37
|
+
manage things like SSL certificates on your behalf.
|
|
38
38
|
|
|
39
39
|
In this setup your private network isn't exposed to the public internet at all.
|
|
40
|
-
Instead, your Zuplo
|
|
40
|
+
Instead, your Zuplo Gateway uses a private network connection to reach your
|
|
41
41
|
backend services.
|
|
42
42
|
|
|
43
43
|
<Diagram height="h-48">
|
|
44
44
|
<DiagramNode id="client">Client</DiagramNode>
|
|
45
45
|
<DiagramGroup id="dedicated-vpc" label="Dedicated Network">
|
|
46
46
|
<DiagramNode id="gateway" variant="zuplo">
|
|
47
|
-
Zuplo
|
|
47
|
+
Zuplo Gateway
|
|
48
48
|
</DiagramNode>
|
|
49
49
|
</DiagramGroup>
|
|
50
50
|
<DiagramGroup id="customer-vpc" label="Customer Private Network">
|
|
@@ -54,11 +54,11 @@ backend services.
|
|
|
54
54
|
<DiagramEdge from="gateway" to="backend" />
|
|
55
55
|
</Diagram>
|
|
56
56
|
|
|
57
|
-
## Customer Private Network Ingress to Zuplo
|
|
57
|
+
## Customer Private Network Ingress to Zuplo Gateway
|
|
58
58
|
|
|
59
59
|
If you have custom networking requirements, such as using a static IP address
|
|
60
60
|
you already own, or if you want to run services such as WAFs, IDS/IPS, or other
|
|
61
|
-
security products in front of your
|
|
61
|
+
security products in front of your Zuplo Gateway, Zuplo can be configured to
|
|
62
62
|
accept traffic from your private network and then route it to your backend. Your
|
|
63
63
|
backend could be in the same network as your ingress or in another private
|
|
64
64
|
network.
|
|
@@ -71,7 +71,7 @@ network.
|
|
|
71
71
|
</DiagramGroup>
|
|
72
72
|
<DiagramGroup id="dedicated-vpc" label="Dedicated Network">
|
|
73
73
|
<DiagramNode id="gateway" variant="zuplo">
|
|
74
|
-
Zuplo
|
|
74
|
+
Zuplo Gateway
|
|
75
75
|
</DiagramNode>
|
|
76
76
|
</DiagramGroup>
|
|
77
77
|
<DiagramEdge from="client" to="waf" />
|
|
@@ -10,7 +10,7 @@ configurations or have strict security or compliance requirements.
|
|
|
10
10
|
|
|
11
11
|
Managed Dedicated hosting might be the right choice for you if you need:
|
|
12
12
|
|
|
13
|
-
- To run your
|
|
13
|
+
- To run your Zuplo Gateway on the cloud provider of your choice
|
|
14
14
|
- To customize networking configurations, such as restricting access to the
|
|
15
15
|
public internet
|
|
16
16
|
- Have geographical deployment requirements where the
|
|
@@ -47,7 +47,7 @@ features as you would with edge-based deployments.
|
|
|
47
47
|
|
|
48
48
|
In addition to the standard features, managed dedicated hosting provides:
|
|
49
49
|
|
|
50
|
-
- **Custom Networking Configurations** - Configure your
|
|
50
|
+
- **Custom Networking Configurations** - Configure your Zuplo Gateway to only be
|
|
51
51
|
accessible from specific private networks or IP ranges
|
|
52
52
|
- **Private Networking Options** - Support for provider-native private
|
|
53
53
|
connectivity patterns such as AWS PrivateLink, Azure Private Link, and GCP
|
|
@@ -55,7 +55,7 @@ In addition to the standard features, managed dedicated hosting provides:
|
|
|
55
55
|
- **Isolated Network Deployment** - Your gateway runs in a dedicated, isolated
|
|
56
56
|
network environment for maximum security and isolation
|
|
57
57
|
- **Custom Ingress Options** - Use your own static IP addresses or security
|
|
58
|
-
appliances (WAFs, IDS/IPS) in front of your
|
|
58
|
+
appliances (WAFs, IDS/IPS) in front of your Zuplo Gateway
|
|
59
59
|
|
|
60
60
|
### High Availability
|
|
61
61
|
|
|
@@ -3,8 +3,8 @@ title: "Managed Dedicated: Source Control"
|
|
|
3
3
|
sidebar_label: "Source Control"
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
Zuplo supports GitOps workflows for managing your
|
|
7
|
-
This means that you can store all of your
|
|
6
|
+
Zuplo supports GitOps workflows for managing your Zuplo Gateway configuration.
|
|
7
|
+
This means that you can store all of your Zuplo Gateway configuration in a Git
|
|
8
8
|
repository and use Git to manage changes to your configuration. This allows you
|
|
9
9
|
to track changes to your configuration over time, collaborate with others, and
|
|
10
10
|
easily roll back changes if needed.
|
|
@@ -27,7 +27,7 @@ project.
|
|
|
27
27
|
|
|
28
28
|
## Create a Git Repository
|
|
29
29
|
|
|
30
|
-
Next, you will need to create a Git repository to store your
|
|
30
|
+
Next, you will need to create a Git repository to store your Zuplo Gateway
|
|
31
31
|
configuration. You can use a service like GitHub, GitLab, or Bitbucket to create
|
|
32
32
|
a new repository.
|
|
33
33
|
|
|
@@ -44,7 +44,8 @@ git push -u origin main
|
|
|
44
44
|
|
|
45
45
|
If you are using GitHub, you can connect your Zuplo project to your GitHub
|
|
46
46
|
repository using the Zuplo integration. This will configure Zuplo to
|
|
47
|
-
automatically deploy your
|
|
47
|
+
automatically deploy your Zuplo Gateway when you push changes to your
|
|
48
|
+
repository.
|
|
48
49
|
|
|
49
50
|
For the full instructions on how to connect your Zuplo project to GitHub, see
|
|
50
51
|
[GitHub Integration](../articles/source-control-setup-github.mdx).
|
|
@@ -52,7 +53,7 @@ For the full instructions on how to connect your Zuplo project to GitHub, see
|
|
|
52
53
|
## Custom CI: Deploy your API
|
|
53
54
|
|
|
54
55
|
If you aren't using GitHub, or would like to set up a custom CI/CD pipeline, you
|
|
55
|
-
can use the Zuplo CLI to deploy your
|
|
56
|
+
can use the Zuplo CLI to deploy your Zuplo Gateway.
|
|
56
57
|
|
|
57
58
|
```bash
|
|
58
59
|
npx zuplo deploy --api-key $ZUPLO_API_KEY --project your-project-name --environment my-env
|
|
@@ -3,10 +3,10 @@ title: Function Handler (Custom Handler)
|
|
|
3
3
|
sidebar_label: Function Handler
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
As
|
|
7
|
-
project. This document shows how you can build a
|
|
8
|
-
used by developers building BFF
|
|
9
|
-
custom traffic management.
|
|
6
|
+
As a unified gateway for APIs, AI, and MCP, the Request Handler is the most
|
|
7
|
+
important part of a Zuplo project. This document shows how you can build a
|
|
8
|
+
custom handler - this is often used by developers building BFF
|
|
9
|
+
(backend-for-frontend), doing orchestration or custom traffic management.
|
|
10
10
|
|
|
11
11
|
A request handler is a module with an export that fulfills the following type
|
|
12
12
|
definition (typescript).
|
|
@@ -7,7 +7,7 @@ The MCP (Model Context Protocol) Server handler allows you to run a lightweight,
|
|
|
7
7
|
stateless MCP server on your gateway that automatically transforms your API
|
|
8
8
|
routes into MCP tools.
|
|
9
9
|
|
|
10
|
-
This enables your
|
|
10
|
+
This enables your Zuplo Gateway to seamlessly serve external AI tools and agents
|
|
11
11
|
through [Model Context Protocol](https://modelcontextprotocol.io/introduction)
|
|
12
12
|
interactions by using your existing APIs, without needing to duplicate
|
|
13
13
|
functionality or rebuild business logic in your backend.
|
|
@@ -5,8 +5,7 @@ sidebar_label: URL Forward
|
|
|
5
5
|
|
|
6
6
|
The URL Forward handler proxies requests to a different API without writing any
|
|
7
7
|
code. It appends the incoming path section of the URL onto the specified
|
|
8
|
-
`baseUrl` property, making it ideal for creating
|
|
9
|
-
proxying.
|
|
8
|
+
`baseUrl` property, making it ideal for creating gateways and backend proxying.
|
|
10
9
|
|
|
11
10
|
:::tip
|
|
12
11
|
|
|
@@ -53,9 +53,9 @@ by:
|
|
|
53
53
|
4. **Developer Experience**: Easy configuration and deployment using your
|
|
54
54
|
existing OpenAPI specifications
|
|
55
55
|
|
|
56
|
-
The MCP Server Handler transforms your existing Zuplo
|
|
57
|
-
|
|
58
|
-
|
|
56
|
+
The MCP Server Handler transforms your existing Zuplo Gateway into a powerful
|
|
57
|
+
toolset that AI systems can discover, understand, and invoke - bringing AI
|
|
58
|
+
capabilities directly into your business workflows!
|
|
59
59
|
|
|
60
60
|
## MCP Implementation Options
|
|
61
61
|
|
|
@@ -63,7 +63,7 @@ Zuplo provides two approaches for implementing MCP servers:
|
|
|
63
63
|
|
|
64
64
|
### 1. MCP Server Handler: Transform Routes into AI Tools
|
|
65
65
|
|
|
66
|
-
The MCP Server Handler automatically transforms your
|
|
66
|
+
The MCP Server Handler automatically transforms your gateway routes into MCP
|
|
67
67
|
tools that AI systems can discover and use.
|
|
68
68
|
|
|
69
69
|
#### How It Works
|
package/docs/policies/_index.md
CHANGED
|
@@ -5,10 +5,10 @@
|
|
|
5
5
|
| set-query-params-inbound | Add or Set Query Parameters | Adds or sets query parameters on the incoming request. | api-gateway |
|
|
6
6
|
| set-headers-inbound | Add or Set Request Headers | Adds or sets headers on the incoming request. | api-gateway |
|
|
7
7
|
| ai-gateway-auth-v2-inbound | AI Gateway Authentication | Authenticates requests to an AI Gateway endpoint with application API keys. Add this policy to an application's `inboundPolicyChain` to require a key for that app only, or place it on the route before the configuration executor to require a key for every application on the route. The policies that follow can read the authenticated application from `request.user` (`sub` is the application name, `data` its metadata), and the application's AI Gateway configuration takes effect for the request. Use `authHeader` and `authScheme` when clients send their app key somewhere other than the default `Authorization: Bearer` header. When the matched route captures an `app_id` path parameter (platform catch-all `/:app_id/(.*)`), this policy also requires `configuration.id === request.params.app_id` and returns 403 on mismatch. | ai-gateway |
|
|
8
|
-
| ai-gateway-configuration-executor-v2-inbound | AI Gateway Configuration Executor | Loads the app configuration for the request (when auth or the configuration loader has not already)
|
|
8
|
+
| ai-gateway-configuration-executor-v2-inbound | AI Gateway Configuration Executor | Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root. Place this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-v2-inbound`. When either of those already populated the app-configuration channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. Applications select from policies pre-declared by the gateway. Applications without a `inboundPolicyChain`, or with an empty chain, run no application-selected policies. Entry options replace the declaration's options as a complete object; omit them to inherit the declaration, including environment-backed credentials. Each occurrence receives a private deep copy of its entry options, so a policy mutating its options cannot corrupt the cached app configuration. | ai-gateway |
|
|
9
9
|
| ai-gateway-configuration-loader-v2-inbound | AI Gateway Configuration Loader | Loads the AI Gateway app configuration for the request into the request-scoped channel and does nothing else. Place this policy on AI Gateway routes before `ai-gateway-configuration-executor-v2-inbound` when you want configuration loading separated from chain execution. When `ai-gateway-auth-v2-inbound` already populated the channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. If this policy is omitted, the configuration executor still loads configuration itself before running the application chain. | ai-gateway |
|
|
10
10
|
| ai-gateway-fallback-model-v2-inbound | AI Gateway Fallback Model | Adds failure and quota fallbacks to an existing AI Gateway model selection. Place this policy after AI Gateway Model Filtering. It never creates a model selection, so a misplaced policy cannot bypass filtering. | ai-gateway |
|
|
11
|
-
| ai-gateway-metering-v2-inbound | AI Gateway Metering | Meters AI Gateway usage and enforces
|
|
11
|
+
| ai-gateway-metering-v2-inbound | AI Gateway Metering | Meters AI Gateway usage and enforces limits configured by the application. The authentication policy must run before this policy so the app configuration id is available for meter storage and analytics. | ai-gateway |
|
|
12
12
|
| ai-gateway-model-filtering-v2-inbound | AI Gateway Model Filtering | Matches AI Gateway requests against curated allow lists or open block lists, then stores the winning model reference for the route handler. | ai-gateway |
|
|
13
13
|
| ai-gateway-semantic-cache-v2-inbound | AI Gateway Semantic Cache | AI Gateway Semantic Cache policy. This inbound policy looks up the semantic cache on entry and, on a miss, registers a response-sending hook to write the upstream response back into the cache. Caching parameters (semanticTolerance, expirationSecondsTtl, namespace, recentMessageCount) come from the policy options, and presence in the route's chain is what enables it. An id from the authenticated app configuration always provides the cache namespace so application-supplied options cannot cross tenant partitions. The cache key covers the system prompt plus the last `recentMessageCount` messages (default 1) — applied when storing and when matching — so multi-turn conversations can hit entries cached from earlier, shorter ones. Cache outcomes are reported on the response via the RFC 9211 `Cache-Status` header under the cache name `zp-aigw-sem-cache` (hit: `zp-aigw-sem-cache; hit; detail="similarity=0.93"`; miss: `zp-aigw-sem-cache; fwd=miss; stored`). Responses also include the `x-ai-gateway-cache: HIT\|MISS` and `x-ai-gateway-cache-similarity` headers. | ai-gateway |
|
|
14
14
|
| akamai-ai-firewall-v2-inbound | Akamai AI Firewall | Akamai AI Firewall Inbound Policy | ai-gateway |
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
"requiresAI": true,
|
|
13
13
|
"policyType": "ai-gateway-configuration-executor-v2",
|
|
14
14
|
"products": ["ai-gateway"],
|
|
15
|
-
"description": "Loads the app configuration for the request (when auth or the configuration loader has not already)
|
|
15
|
+
"description": "Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root.\n\nPlace this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-v2-inbound`. When either of those already populated the app-configuration channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. Applications select from policies pre-declared by the gateway. Applications without a `inboundPolicyChain`, or with an empty chain, run no application-selected policies. Entry options replace the declaration's options as a complete object; omit them to inherit the declaration, including environment-backed credentials. Each occurrence receives a private deep copy of its entry options, so a policy mutating its options cannot corrupt the cached app configuration.",
|
|
16
16
|
"deprecatedMessage": "",
|
|
17
17
|
"required": ["handler"],
|
|
18
18
|
"properties": {
|