Kong is a full lifecycle API management company that’s become the backbone of cloud connectivity for some of the world’s biggest brands. Trusted by companies like PayPal, GSK, NASDAQ, and Wayfair to connect their software and services to people online, Kong’s suite of products are indispensable in their clients’ transitions from monolithic applications to distributed, cloud-native microservices architectures.

For Kong, flawless software distribution is more than a convenience; it’s a necessity for them, their clients, a wide footprint of open-source users, and the world’s web users. API traffic represents over 83% of global internet traffic today. Kong handles a significant portion of this, with some of the internet's highest-volume and most critical traffic relying on its technology—like banks, airlines, and e-commerce giants. Every Kong client runs a part of Kong’s stack on their networks. So whether it’s Kong’s routine upgrades or urgent patches, seamless delivery of its updates is vital in order for its clients to maintain functionality, accessibility online, and security.

According to Kong’s SVP of Engineering, Saju Pillai, Kong’s role as digital bridge—plus the sheer amount of traffic dependent on it—means the consequences of a Kong distribution failure could be considerable. “A two day delay on our side in distributing a patch could translate into millions of dollars lost for an unfortunate customer,” he explains. “So the impact would be unusually high.”

Despite software distribution being a key requirement for success at Kong, its DevOps team encountered numerous challenges with its previous software distribution solution, Pulp, including:

• the operational costs to run it;
• CI/CD disruptions; and
• impacts on product agility.

Relying on an open-source, on-premises solution for distribution left Kong responsible for running and maintaining its own instance of Pulp. This required a team of three senior DevOps engineers primarily dedicated to handling those intricacies, from day-to-day distribution to troubleshooting and optimization.

Over time, Kong’s longevity and growth as a business made distribution more complex, which intensified the strain on the tooling and team responsible for it. “Kong has quite a lot of artifacts that need to be distributed,” says Saju. “At last count we had about 82 different versions of our software across various operating systems and product iterations. The number has really climbed. And having three people just running Pulp no longer computed financially or from a resource allocation perspective.”

Operational issues with Pulp and its associated databases were also a recurring headache for Kong. For a while, CI/CD may as well have stood for constant irritation/continuous disruption. “We had one instance too many of Pulp going down,” says Saju, “but this was not new. I recall some security tightening we had to do for our accounts, and it caused a problem. Our customers could not download packages for two days, and that just won’t do.”

“A lot of our customers and OSS users are on Kubernetes,” he adds, “and it’s common for our Kubernetes-based deployments to be pointing to the latest and greatest images that clients need to pull down. These Helm charts and other automation are part of their regular day-to-day Kubernetes flow. So image unavailability or a problem in distribution of Kong artifacts can result in a meaningful breakage in their Kubernetes flows.”

The frequent outages frustrated Saju’s team and led to recurring customer complaints about availability and uptime. But Saju also recognized the threat this unreliability posed to credibility and business expansion. “A lot of our customers come from regulated industries with very strict requirements and considerations. So their ability to take a signed artifact, for example, be able to prove that it’s signed properly, and make sure that it's ready, that’s key to our ability to enter these markets and grow. We need to be able to ship what we need to ship at the frequency we need to ship, because as a global company—every minute of the day— there is somebody, somewhere looking to download something from us right now.”

Finally, the process of deploying custom builds for design partners was cumbersome and compounded Kong's distribution hardships. The effort and lead time required for reconfiguration made client personalization and design experimentation extremely difficult, hindering Kong's agility in meeting customer needs and innovating at pace.

As the challenges of managing its own distribution infrastructure began to outweigh the benefits, Saju and his team reconsidered their approach. “As much as distribution is important to us,” he explains, “continuing to try to solve that in-house just did not make sense. We wanted an expert at this to solve it for us so that we could focus on what we are core at and depend on a partner to do the heavy lifting in this area.”

In spring 2023 his team of frustrated engineers went looking for a specialized, fully-managed alternative to Pulp and discovered Cloudsmith. “Working with Cloudsmith was great,” he recalls. “I remember my engineers essentially championing Cloudsmith. It is a little unusual for engineers to be okay wanting to talk to salespeople and participate in the [sales] cycle, but from our side, the cycle was almost completely led by the engineers, so that was a big plus-one in my book.”

Cloudsmith’s engineering-first approach to artifact distribution and profound understanding of customer needs immediately resonated with Kong's team. Although they considered competitors in the market, his engineers felt the other solutions didn’t measure up to Cloudsmith. “The primary reason for selecting Cloudsmith was it just felt modern, open, and at a company level a company that we could work with easily—a company that would appeal to an engineer more than the other vendors that we had looked at,” says Saju. “Plus, the feature set all just made sense to us, and how Cloudsmith was looking at the problem computed very well for our engineers.”

With the Kong and Cloudsmith teams so deeply aligned, engagement was fast and simple. In just five months, Kong had trialed Cloudsmith, swiftly agreed on terms and conditions, opted for Cloudsmith's Enterprise Ultra plan, and had:

• fully onboarded;
• completed its set up in Cloudsmith;
• retooled and configured the automations that had previously relied on Pulp;
• migrated its artifacts; and
• successfully pushed its first release using Cloudsmith, marking a major turning point in its software distribution capability.

Transitioning to Cloudsmith has yielded a host of improvements for Kong, transforming its software distribution workflow and bolstering its operational efficiency and resilience. Perhaps most notably, Kong's engineers have embraced Cloudsmith with gusto, a testament to the Cloudsmith platform's seamless integration, standout performance, and user-friendliness. “When my engineers tell me that they love a vendor, then I know not to question further,” says Saju. “You can't get a harsher critic than an engineer, and our engineers love Cloudsmith.”

Thanks to Cloudsmith's fully-managed, fully-hosted platform, shipping updates to Kong’s 40,000+ customers is now consistently effortless—so much so that its former Pulp experts have relinquished ALL of their distribution duties. “I have literally saved three whole headcounts here,” says Saju. ”That is a major savings. Our three engineers who were mostly taking care of our distribution problems have now been redistributed into other areas. I actually do not have a software distribution specialist in my organization anymore. We just have our regular development teams that just continue working and building, and Cloudsmith just does its work.”

This strategic reallocation of staff also allows other teams to benefit from the valuable skills, expertise, and experience of senior engineers—strengthening Kong’s overall organizational agility and effectiveness.

With over 7,000 Kong packages/600GB stored and approximately 21K asset downloads by its customers each month, Saju is delighted with how deftly Cloudsmith has handled Kong’s distribution load and the hassle-free access his customers are enjoying round-the-clock.

Cloudsmith’s lightning-fast global CDN, spanning 600 points of presence, is providing instant access to Kong's artifacts to its customers, teams, and systems worldwide. And Cloudsmith’s support for native tooling allows developers to pull the latest assets with zero friction. Elastic load handling is ensuring smooth operation even during activity spikes.

“Inside Kong, we talk about robustness as what we call the high-order bit,” he says. “First make everything work exactly like you promised the customer, and then introduce new features, but without compromising robustness. And I see that with Cloudsmith. Our CI/CD pipelines, they come all the way into the distribution step and we just hand it over to Cloudsmith and it works beautifully. “Once we got the bulk of our assets moved from Pulp into Cloudsmith, we saw an instant drop in escalations,” he continues. “We used to get complaints from customers about availability, uptime of our distribution mechanisms, and their ability to reach and download images. Post the Cloudsmith switch, the complaints have literally gone to zero. We have had absolutely no complaints from our DevOps and CI/CD-heavy customers.

“I've not had a single upset customer or angry email from our support teams saying, “Hey, we have an issue with downloading patches”, so that has been fantastic,” he adds. “The downloading of artifacts is not a concern for me at all anymore. Moving to Cloudsmith was a great decision for us.”

While Kong’s newfound distribution performance and reliability has eased and accelerated its day-to-day software delivery, it’s also made trialing new ideas with customers and delivering bespoke solutions markedly more convenient, both of which are integral to continuous improvement and surpassing client expectations.

“The ease with which we have been able to release one-off custom builds for our design partner customers that want to try out something, etc,” explains Saju, “I remember the lead time that used to go into configuring Pulp to do this—all the issues that would happen. [Now], basically it's like no news is awesome news.”

24/7 asset access and availability is Kong’s new normal, alleviating its concerns about global customer demands and renewing its confidence in its ability to meet the needs of regulated industries. And as Kong expands, Cloudsmith’s fully-managed service, cloud-native architecture, and automatic provisioning means Kong can enjoy ongoing distribution speed and efficiency without any DevOps intervention.

Already, Kong has undergone a 66% increase to its network bandwidth with none of the DevOps effort typically required of on-premises solutions. Cloudsmith takes care of it all. As a high-growth company with a mission to enable the world’s software makers to become API-first, this operational support gives Kong scope to grow and distribute infinitely without ever compromising the customer experience or burdening DevOps.

Overall, Saju says Cloudsmith has exceeded Kong's expectations, delivering the unparalleled performance, reliability, and convenience that is integral to its continued success.

“Cloudsmith is key to our CI/CD and DevOps stack now,” he says. “It should be a tool in the DevOps toolkit for everyone. When you think about the amount of energy and time and money that companies spend solving the software distribution problem in-house, I don't think that can be properly justified, anymore, when Cloudsmith exists.

“The fact that they have engineers being their champions,” he continues, “the fact that our engineers chose to move off a technology that they had personally invested in and built in order to go to Cloudsmith…the fact that eight months in we still have not needed to file a support case…that’s like black magic, and those are very good reasons why large companies should be looking at Cloudsmith.”