The API gateway

Key points

• One public entry point routes to internal services. Clients see one host, one TLS certificate, one set of rules.
• The gateway owns cross-cutting work: TLS termination, token validation, rate limiting, CORS, request logging.
• It also hides your topology. Split a service in two and the client's URL does not change.
• Keep business logic out of it. A gateway that knows your domain becomes a shared bottleneck every team must deploy through.
• Common choices: Spring Cloud Gateway, Kong, Envoy, or the Kubernetes ingress controller you already run.

Example

# Spring Cloud Gateway routes.
# Note: newer Spring Cloud releases nest these under
# spring.cloud.gateway.server.* - check the docs for your version.
spring:
  cloud:
    gateway:
      routes:
        - id: orders
          uri: http://orders:8080          # internal name, never exposed
          predicates:
            - Path=/api/orders/**
          filters:
            - StripPrefix=1                # /api/orders/42 -> /orders/42
            - name: CircuitBreaker
              args:
                name: ordersCb
                fallbackUri: forward:/fallback/orders
        - id: inventory
          uri: http://inventory:8080
          predicates:
            - Path=/api/stock/**

One front door for clients, many small doors inside.