Conduktor Gateway vs Kroxylicious: Kafka Proxy Compared
Kroxylicious is a framework for building a Kafka proxy. Conduktor Gateway is a finished one, supported and configured at runtime. The question is whether your team wants to build the proxy or run it.
A framework, not a product. That's the point.
Kroxylicious calls itself a network proxy framework for Apache Kafka, and the description is accurate. You get a protocol-aware core, a filter API, and a handful of filters. Everything else is yours to write in Java and configure in YAML, instance by instance.
The project is healthy and Apache 2.0, and of the open-source proxies it's the one platform teams evaluate seriously. What it doesn't come with is support: the community edition has no SLA, and Red Hat's packaged version is still a Technology Preview. The trade is engineering time for license cost, and it's a fair trade for some teams.
Competitor details last checked against kroxylicious.io, the GitHub releases, and Red Hat documentation, September 2026.
Where Conduktor Gateway and Kroxylicious diverge
Four questions that decide the build-or-run evaluation.
Isolation, not naming
Virtual clusters layered with ACLs and traffic policies per tenant. Kroxylicious separates tenants by topic prefix.
An API, not a config file
Interceptors, policies, and cluster switching change through an API, CLI, or Terraform, consistently across every Gateway instance. Kroxylicious hot-reloads a YAML file per instance; keeping a fleet consistent is your job.
Data controls that ship
Field-level and payload encryption, masking, data quality rules, and Schema Registry authorization, configured rather than written. Kroxylicious ships record encryption and schema validation; the rest is a filter you write.
Someone on the hook
Enterprise support with an SLA, and a proxy in production at regulated enterprises such as CDC Informatique. Kroxylicious support is the community, or a Red Hat Technology Preview.
Conduktor Gateway vs Kroxylicious: feature comparison
Conduktor Gateway is licensed per cluster on the Enterprise plan; the free Community Edition covers cross-network reachability only. Where a row depends on that, the note says so.
| Capability | Conduktor Gateway | Kroxylicious |
|---|---|---|
| License & cost | ⚠Commercial, per cluster with a 3-cluster minimum; free Community Edition for network reachability only. See pricing → | ✓Apache 2.0, free; Red Hat's packaged version is a Technology Preview |
| Support | ✓Enterprise support and SLA; GA and in production at regulated enterprises | ⚠Community support; no production SLA from Red Hat while in Technology Preview |
| Extensibility | ⚠Composable interceptors configured per virtual cluster; custom interceptors in Java for edge cases | ✓Filter API designed for you to write your own, in Java |
| Multi-tenancy | ✓Virtual clusters with isolated namespaces, ACLs, quotas, and traffic policies stacked per tenant; topic concentration | ⚠Prefix-based multi-tenant filter; no layered isolation or concentration |
| Configuration & change | ✓REST API, CLI, and Terraform provider; changes apply at runtime across all instances | ⚠YAML configuration with per-instance hot reload of filter chains (routing reload behind a feature flag); no API, and no mechanism to keep multiple instances consistent |
| Cluster switching & failover | ✓Switch clusters through one API call, no client reconfiguration; chaos-testing interceptors to rehearse it | ⚠Achievable by changing the target cluster in each instance's config; controlled failover is an open feature request; no readiness tooling |
| Replication | ✗Gateway routes; it doesn't replicate. Pair with MirrorMaker 2, Replicator, or Cluster Linking | ✗Same: a proxy, not a replicator |
| Automatic failover | ⚠Triggered by API call, not by health check; switching is all-or-nothing today | ✗Not available |
| Encryption | ✓Field-level and full-payload encryption with KMS integration (Vault, AWS KMS, Azure Key Vault, GCP KMS), plus masking and tokenization | ⚠Record-level envelope encryption with KMS-backed keys; no field-level encryption, masking, or tokenization |
| Data quality | ✓Schema enforcement plus CEL business rules on the wire; violations blocked or logged per policy | ⚠Record validation against JSON Schema, Avro, or Protobuf; business rules are custom filters |
| Schema Registry governance | ✓Schema Registry Proxy: JWT/OIDC authentication, per-subject authorization, audit | ✗Not in scope |
| Best-practice guardrails | ✓Topic creation policies, producer and consumer safeguards, rate limits, large-message handling, per virtual cluster | ⚠Custom filters per rule |
| Partner data sharing | ✓Partner Zones: isolated virtual clusters with per-partner masking, credentials, and rate limits | ✗Not available |
| Authentication | ✓mTLS, SASL, OIDC/OAuth; centralized service accounts and audit | ✓mTLS and SASL passthrough; experimental ACL authorizer |
| Kafka providers | ✓Any Kafka 2.7+: Confluent, MSK, Redpanda, Aiven, Apache Kafka | ✓Any Apache Kafka-protocol cluster |
| Observability | ✓Prometheus metrics, audit log, management UI in Console | ✓Prometheus metrics; UI is yours to build |
IncludedPartial or gated behind a higher tierNot available
Multi-tenancy
Isolation you configure once, not a prefix convention
Each team gets a virtual cluster: its own namespace, credentials, ACLs, quotas, and policies on shared brokers. Topic concentration folds hundreds of low-volume topics into fewer physical partitions. Kroxylicious' multi-tenant filter rewrites topic names by prefix, which keeps teams from colliding but doesn't give them their own limits or rules.
Data quality and security
Encryption, masking, and rules that arrive as configuration
Field-level encryption, masking, and CEL-based data quality rules are interceptors you enable per virtual cluster, blocking or logging records that fail. Kroxylicious gives you a solid record-encryption filter and schema validation for JSON, Avro, and Protobuf; masking, tokenization, and business rules are filters your team writes and maintains.
Failover
The switch is an API call. The rehearsal is built in.
Gateway routes clients to a failover cluster with one call and no client changes, and its chaos-testing interceptors let you break brokers on purpose to prove your applications survive it. Gateway doesn't replicate data, so MirrorMaker 2, Replicator, or Cluster Linking still does that job, and the switch is triggered by you rather than a health check. With Kroxylicious, the switch is a config change on every instance, and rehearsing it is something you build.
Kroxylicious fits if...
You have Java engineers with time allocated to a proxy, a short list of requirements that its filters already cover (record encryption, prefix tenancy, schema validation), and you want to own the code. It's the strongest open-source starting point.
Conduktor Gateway fits if...
You need the proxy in production this quarter, several teams will share it, you need field-level encryption, masking, or Schema Registry governance, and you'd rather your platform engineers build your platform than maintain a proxy. Support and a fleet-wide API are included.
"The Gateway proxy won me over immediately."
Julien Maillard
Senior Architect, CDC Informatique
Read more customer stories
Is Kroxylicious production-ready?
The core proxy is stable and releases regularly (0.24.0 in September 2026), and teams do run it in production. What you take on is everything around it: writing filters for policies it doesn't ship, per-instance YAML change management, and your own support rotation. Red Hat's packaged version is a Technology Preview, so it doesn't come with a production SLA either.
What does Kroxylicious cost?
The software is free under Apache 2.0. The cost is engineering time: building and maintaining filters, operating the proxy in the data path, and being on call for it. Most teams that compare the two find the engineering bill exceeds a Gateway license within the first year, before counting what those engineers weren't building.
Can we start on Kroxylicious and move to Conduktor Gateway later?
Yes. Both sit in front of standard Kafka brokers and are transparent to clients, so migrating means re-pointing bootstrap servers and re-expressing your policies as Gateway interceptors. Nothing about the brokers or topics changes.
Does Conduktor Gateway replicate data for disaster recovery?
No, and neither does Kroxylicious. Gateway switches client traffic between clusters; replication is MirrorMaker 2, Confluent Replicator, or Cluster Linking. Gateway's contribution is that the switch takes one API call and no client changes, and that you can rehearse it with chaos testing.
Is there a free Conduktor Gateway?
Gateway Community Edition is free with no time limit, scoped to cross-network reachability: it lets clients reach brokers in other VPCs and clouds. Interceptors, virtual clusters, encryption, and failover are on the Enterprise plan, priced per cluster.
Can I write custom logic in Conduktor Gateway like a Kroxylicious filter?
Yes. Gateway ships composable interceptors for the common policies, and supports custom interceptors in Java for anything specific to you. The difference is the starting point: with Gateway most requirements are configuration, and code is the exception.
See Gateway in front of your clusters
Thirty minutes: virtual clusters, encryption on the wire, and a failover you can rehearse, on the Kafka you already run.