Gateway

Conduktor Gateway is a commercial Kafka proxy designed for platform teams that need to enforce security, governance, and multi-tenancy policies at the infrastructure layer without modifying producer or consumer code.

Reviewed by 7wData

On this page

Publisher review

Conduktor Gateway is a commercial Kafka proxy designed for platform teams that need to enforce security, governance, and multi-tenancy policies at the infrastructure layer without modifying producer or consumer code. It sits between Kafka clients and brokers, intercepting all traffic to apply encryption, data masking, quota enforcement, and routing rules transparently. The product targets enterprise environments where compliance with standards like PCI DSS, HIPAA, and GDPR is critical, and where multiple teams share a Kafka infrastructure. It is particularly suited for organizations that want to offer self-service topic creation within defined guardrails, reducing the operational burden on central platform teams.

The Gateway works by speaking the native Kafka wire protocol, so clients connect to it as if it were a broker—just update the `bootstrap.servers` address. It provides field-level encryption and data masking, integrating with key management systems including AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault, and Fortanix. The 'Topic as a Service' feature allows teams to self-serve topic creation within policy guardrails, a capability that received strong praise at Kafka Summit London 2024. Operational tooling includes a Terraform provider (GA), CLI, and runtime API. For disaster recovery, the Gateway supports API-driven route automation and chaos testing to validate failover scenarios. It also enables cross-network connectivity and zero-application changes for data sharing between partners.

In the Kafka proxy market, Conduktor Gateway competes with Confluent Gateway, Kroxylicious, Gravitee Kafka Gateway, Aklivity Zilla, and Kong Event Gateway. Unlike Confluent Gateway, which offers only network-level multi-tenancy and no policy enforcement at the proxy layer, Conduktor provides layered isolation with virtual clusters and composable interceptors for best-practice enforcement. Kroxylicious is open-source but unsupported in its community edition, while Gravitee and Kong are API management platforms that added Kafka support later. Conduktor Gateway is purpose-built for Kafka, with years of production deployments and a broader feature set for data security, schema registry governance, and external data sharing.

However, the Gateway introduces real trade-offs. It adds 2-10ms of latency per request and requires a PostgreSQL 13+ dependency for its control plane. The proxy itself becomes a single point of failure that must be managed for high availability. Known gaps include the absence of distributed tracing and no integration with Azure's native Schema Registry. The free Community Edition is restricted to 50 users and 3 clusters as of version 1.43, and connecting to SSL-enabled or multi-broker clusters requires a paid plan. Per-seat pricing on the Team Edition at $1,200 per seat per year can become a significant cost for teams above 20-30 users, with estimated annual costs of $80,000-$150,000 for 100 users across three clusters.

Get the AI & data signal, daily.

335k+ subscribers read this every morning. One email, both newsletters. Unsubscribe anytime.

How it works

  1. Wire-level encryption and policy enforcement

    Enforces encryption and data policies at the infrastructure layer without requiring changes to producer or consumer application code.

  2. Field-level encryption and data masking

    Provides field-level encryption, data masking, and tokenization, integrating with AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault, and Fortanix.

  3. Self-service topic creation with guardrails

    Teams can create topics within defined policy guardrails via the Topic as a Service feature, reducing platform team bottlenecks.

  4. Multi-tenancy with layered isolation

    Supports virtual clusters and layered isolation for multi-tenancy, allowing platform teams to scale Kafka across teams without multiplying infrastructure.

  5. Disaster recovery with chaos testing

    Provides API-driven route automation and chaos testing to validate disaster recovery scenarios, going beyond simple replication.

  6. Operational tooling: Terraform, CLI, API

    Includes a GA Terraform provider, CLI, and runtime API for infrastructure-as-code management and automation of proxy configurations.

  7. Schema registry governance

    Offers authentication, access control, and audit for schema registries, supporting Confluent-compatible and AWS Glue integrations.

Strengths and trade-offs

Strengths

  • Enforces encryption and policy at the wire level without modifying producer or consumer code, reducing application team effort.
  • Integrates with five major key management systems (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault, Fortanix) for field-level encryption.
  • Provides a GA Terraform provider, CLI, and runtime API for infrastructure-as-code management of proxy configurations.
  • Supports API-driven disaster recovery with chaos testing, enabling validation of failover scenarios without manual redeployment.

Trade-offs

  • Adds 2-10ms of latency per request and requires a PostgreSQL 13+ dependency for its control plane, increasing operational overhead.
  • The proxy becomes a single point of failure that must be managed for high availability, adding complexity to deployments.
  • Known gaps include the absence of distributed tracing and no integration with Azure's native Schema Registry.
  • Per-seat pricing at $1,200 per seat per year on the Team Edition can cost $80,000-$150,000 annually for 100 users across three clusters.

Pricing context

Community Edition: free for up to 50 users and 3 clusters, with full Kafka operations, Insights, CLI, Terraform, and SSO/LDAP. Team Edition: $125/month per seat or $1,200/year per seat, adding federated ownership, unlimited audit logs, topic policies, and priority support.

Getting started with Gateway

  1. Sign up for Conduktor Gateway

    Go to the Conduktor website and create an account. Choose the Community Edition for up to 50 users and 3 clusters, or contact sales for a Team Edition trial. Complete the registration and verify your email to access the download portal.

  2. Download and install Gateway

    Download the Gateway binary from the Conduktor portal. Install it on a server that meets the requirements: PostgreSQL 13+ for the control plane and network access to your Kafka brokers. Follow the installation guide to set up the proxy as a service.

  3. Configure connection to Kafka brokers

    Edit the Gateway configuration file to specify your Kafka broker addresses, authentication credentials, and PostgreSQL connection details. Set the bootstrap.servers to point clients to the Gateway instead of directly to brokers. Restart the Gateway to apply changes.

  4. Define a data masking policy

    Use the Gateway CLI or API to create a policy that masks sensitive fields in Kafka messages. For example, mask credit card numbers in the 'payment' topic by specifying the field path and masking type. Apply the policy to a virtual cluster to enforce it transparently.

  5. Verify policy enforcement with a test producer

    Configure a Kafka producer to send messages to the Gateway's bootstrap address. Produce a message containing sensitive data to the 'payment' topic. Consume the message from a consumer to confirm that the Gateway masked the field as defined in the policy.

Frequently Asked Questions

What is Conduktor Gateway and how does it work?

Conduktor Gateway is a commercial Kafka proxy that sits between clients and brokers to enforce security, governance, and multi-tenancy policies at the infrastructure layer. It speaks the native Kafka wire protocol, so clients connect to it as if it were a broker by updating the bootstrap.servers address.

What security features does Conduktor Gateway offer?

Conduktor Gateway provides wire-level encryption, field-level encryption, data masking, and tokenization. It integrates with key management systems like AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault, and Fortanix, all without requiring changes to producer or consumer application code.

How does Conduktor Gateway support self-service topic creation?

Conduktor Gateway's Topic as a Service feature allows teams to self-serve topic creation within defined policy guardrails. This reduces the operational burden on central platform teams and was praised at Kafka Summit London 2024 for enabling self-service while maintaining governance.

What are the main trade-offs of using Conduktor Gateway?

Conduktor Gateway adds 2-10ms of latency per request and requires a PostgreSQL 13+ dependency for its control plane. The proxy becomes a single point of failure needing high availability management. It also lacks distributed tracing and Azure native Schema Registry integration.

How does Conduktor Gateway pricing work?

Conduktor Gateway offers a free Community Edition for up to 50 users and 3 clusters. The Team Edition costs $125 per seat per month or $1,200 per seat per year, with per-seat pricing that can reach $80,000-$150,000 annually for 100 users across three clusters.

How does Conduktor Gateway compare to Confluent Gateway?

Unlike Confluent Gateway, which offers only network-level multi-tenancy and no policy enforcement at the proxy layer, Conduktor Gateway provides layered isolation with virtual clusters and composable interceptors. It is purpose-built for Kafka with broader data security and governance features.

Alternatives

How Gateway compares

Direct head-to-head against 3 competitors. Picked by 7wData.

This tool

Gateway

Pricing
Community Edition: free for up to 50 users and 3 clusters, with full Kafka operations, Insights, CLI, Terraform, and SSO/LDAP. Team Edition: $125/month per seat or $1,200/year per seat, adding federated ownership, unlimited audit logs, topic policies, and priority support.
Target
Conduktor Gateway is a commercial Kafka proxy designed for platform teams that need to enforce security, governance, and multi-tenancy policies at the infrastructure layer without
Strength
Enforces encryption and policy at the wire level without modifying producer or consumer code, reducing application team effort.
Watch for
Adds 2-10ms of latency per request and requires a PostgreSQL 13+ dependency for its control plane, increasing operational overhead.

Kong

Pricing
OSS free; Konnect Plus ~$105/month per service + $200/million extra requests; Enterprise custom.
Target
Enterprises needing a unified API + AI gateway with multi-model support and hybrid deployment.
Deployment
Self-hosted, Kubernetes, Konnect cloud.
Strength
Extensible plugin ecosystem with Lua, Go, and Wasm support.
Watch for
SSO and audit logs locked behind Enterprise tier; multi-dimensional pricing can escalate.

Apigee

Pricing
Pay-as-you-go: $20/million standard calls, $100/million extensible; environments $365-$3,431/month.
Target
Large enterprises needing deep Google Cloud integration and advanced API analytics.
Deployment
Google Cloud managed, hybrid, on-premises.
Strength
Advanced API analytics and monetization features built in.
Watch for
Extensible proxy calls cost 5x standard; per-environment charges add up quickly.

Tyk

Pricing
OSS free; Tyk Cloud from $500/month; Enterprise custom pricing.
Target
Teams seeking an open-core gateway with GraphQL support and multi-cloud flexibility.
Deployment
Self-hosted, Kubernetes, Tyk Cloud.
Strength
Native GraphQL gateway with schema stitching and federation.
Watch for
Enterprise features like RBAC and SSO require paid tiers; community edition has limited plugins.

User reviews

No user reviews yet. Be the first to write one.

Sources

Reporting on this tool draws on these publicly available sources.

  1. factorhouse.io
  2. www.conduktor.io
  3. www.conduktor.io
  4. www.conduktor.io