Kong Software Engineering Intern India 2026

Context: Kong’s API gateway needs to enforce rate limits across multiple clients. Write a rate limiter that allows at most N requests per second per client ID, and works in a concurrent environment.

package main

import (
    "sync"
    "time"
)

type RateLimiter struct {
    mu      sync.Mutex
    limits  map[string][]time.Time
    maxReqs int
    window  time.Duration
}

func NewRateLimiter(maxReqs int, window time.Duration) *RateLimiter {
    return &RateLimiter{
        limits:  make(map[string][]time.Time),
        maxReqs: maxReqs,
        window:  window,
    }
}

func (rl *RateLimiter) Allow(clientID string) bool {
    rl.mu.Lock()
    defer rl.mu.Unlock()

    now := time.Now()
    timestamps := rl.limits[clientID]

    // Remove timestamps older than the window
    cutoff := now.Add(-rl.window)
    valid := []time.Time{}
    for _, t := range timestamps {
        if t.After(cutoff) {
            valid = append(valid, t)
        }
    }

    if len(valid) < rl.maxReqs {
        valid = append(valid, now)
        rl.limits[clientID] = valid
        return true
    }
    return false
}

Explanation: Use a mutex to protect the map. Store timestamps of successful requests and prune the slice on every call. Alternative: token bucket with atomic operations for better performance.

Context: Kong is an API gateway. Describe the high‑level architecture of a minimal gateway that routes requests to backend services and validates an API key.

Key components: Configuration store (routes, services), proxy layer (HTTP reverse proxy), plugin mechanism for authentication, rate limiting, logging. Explain how you’d handle concurrency, timeouts, and hot reloading.

// Pseudo design:
 1. Read config (routes: host/path -> upstream)
 2. HTTP server with middleware chain:
    - Authentication (check API key in header)
    - Rate limiting
    - Proxy forward (http.ReverseProxy)
 3. Use context for cancellation and timeouts
 4. Use goroutines per request (Go’s net/http does that)

Explanation: Emphasize separation of concerns, concurrency safety, and how to integrate with cloud services (e.g., using service discovery).

Problem: Given a string, find the length of the longest substring without repeating characters.

func lengthOfLongestSubstring(s string) int {
    lastPos := make(map[byte]int)
    start, maxLen := 0, 0
    for i := 0; i < len(s); i++ {
        if pos, ok := lastPos[s[i]]; ok && pos >= start {
            start = pos + 1
        }
        lastPos[s[i]] = i
        if i-start+1 > maxLen {
            maxLen = i - start + 1
        }
    }
    return maxLen
}

Explanation: Sliding window with a map to store the last index of each character. O(n) time.

Question: Explain the difference, and where Kong (API gateway) fits.

Forward proxy: Sits between client and internet, used for anonymity, caching, or bypassing restrictions. Reverse proxy: Sits between internet and backend servers, used for load balancing, security, SSL termination. Kong acts as a reverse proxy (with added features like authentication, transformation, analytics).

Also mention that Kong can be deployed as a sidecar (service mesh) or as a central gateway.

System design: High‑level design for a URL shortener. Focus on API endpoints, database schema, hashing, and scalability.

Key points: Use base62 encoding of a unique ID; store mapping in a distributed DB (Cassandra, PostgreSQL with sharding). Cache popular keys with Redis. Discuss 301 vs 302.

func encode(id int64) string {
    const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    base := int64(len(charset))
    var result []byte
    for id > 0 {
        result = append([]byte{charset[id%base]}, result...)
        id /= base
    }
    return string(result)
}

Problem: Write a function that fetches data from 10 URLs concurrently, returns the first successful response (with a 2‑second timeout), and cancels the rest.

func fetchFirst(ctx context.Context, urls []string) (string, error) {
    ctx, cancel := context.WithCancel(ctx)
    defer cancel()

    ch := make(chan string, 1)

    for _, url := range urls {
        go func(u string) {
            req, _ := http.NewRequestWithContext(ctx, "GET", u, nil)
            resp, err := http.DefaultClient.Do(req)
            if err != nil {
                return
            }
            defer resp.Body.Close()
            body, _ := io.ReadAll(resp.Body)
            select {
            case ch <- string(body):
            default:
            }
        }(url)
    }

    select {
    case res := <-ch:
        return res, nil
    case <-time.After(2 * time.Second):
        return "", errors.New("timeout")
    }
}

Explanation: Use context cancellation to stop pending goroutines. A buffered channel ensures we don’t block on the first result.

Question: A service suddenly shows high latency. How would you approach debugging in a cloud‑native environment (Kubernetes + Kong)?

Answer: Check metrics (Prometheus): latency percentiles, error rate, CPU/memory. Inspect logs, distributed tracing (Jaeger). Verify database slow queries, network latency between services, and Kong gateway metrics. Use flame graphs to find bottlenecks. Mention chaos engineering or load testing.

Also check if the upstream service is throttling or if a new deployment caused a regression.

Problem: Given k sorted linked lists, merge them into one sorted list.

type ListNode struct {
    Val  int
    Next *ListNode
}

func mergeKLists(lists []*ListNode) *ListNode {
    if len(lists) == 0 { return nil }
    h := &minHeap{}
    heap.Init(h)
    for _, head := range lists {
        if head != nil {
            heap.Push(h, head)
        }
    }
    dummy := &ListNode{}
    tail := dummy
    for h.Len() > 0 {
        node := heap.Pop(h).(*ListNode)
        tail.Next = node
        tail = tail.Next
        if node.Next != nil {
            heap.Push(h, node.Next)
        }
    }
    return dummy.Next
}

Explanation: Use a min‑heap (priority queue) of size k. Pop smallest, push its next, O(N log k).

Context: Kong's plugin system allows custom logic (authentication, transformation, logging). Explain the concept of access, response, and log phases, and how order matters.

Answer: Plugins run in a chain. Each plugin can hook into different phases: certificate, rewrite, access, response, log. The order is configurable via priorities (higher numbers run first). In the access phase, a plugin can short‑circuit the request (e.g., reject with 401). Understanding this is key to building efficient gateways.

Also mention that custom plugins are written in Lua (or Go using PDK) and are executed in a sandboxed environment.

Problem: You need to count total API requests across millions of clients in a distributed system. How would you implement an eventually‑consistent counter?

Answer: Use a partitioned counter in Redis (sharded) with atomic increments, or use a streaming approach (Kafka) + batch updates to a database. Another approach: use a local counter in each gateway instance and flush periodically to a central store. Discuss trade‑offs between accuracy and scalability. Mention CRDTs if strong eventual consistency is needed.

// Example: sharded Redis increment
func increment(prefix, key string) {
    shard := hash(key) % numShards
    redisClient[shard].Incr(prefix + ":" + key)
}

Explanation: High‑volume counters need to avoid contention. Sharding reduces single‑key bottlenecks.