Kafka Gateway

Gateway

Expose Kafka topics over HTTP, MQTT, gRPC, SSE, and WebSocket without custom code. One stateless runtime: protocol mediation, auth, and schema validation built in.

▸ Quickstart⟨⟩ How It Works

Features

HTTP to Kafka

Map REST routes straight onto Kafka produce and fetch operations, no application code standing in between.

Produce: Create & UpdateMap a POST, PUT, or DELETE to a Kafka message, with an Idempotency-Key header setting the message key so retried requests replay safely.Fetch: Read One & Read ManyMap a GET to a log-compacted topic, filtering by key for one record or merging every distinct key into a single JSON response.Correlated Request-ResponseLet a client wait synchronously for a downstream reply, or poll for it later with prefer: respond-async.

MQTT to Kafka

Terminate MQTT sessions, retained messages, and pub/sub traffic directly on Kafka, no separate broker to run.

Sessions, Retained Messages & Pub/SubStore MQTT session state, retained messages, and published/subscribed traffic on dedicated, compacted Kafka topics.Routing by Topic PatternFan MQTT traffic out to different Kafka topics based on the matched topic filter, no application-level routing logic.

gRPC to Kafka

Bridge gRPC unary and streaming calls onto Kafka topics, with correlation handled by the gateway.

Every RPC Shape, One MechanismMap simple, server-streaming, client-streaming, and bidirectional RPCs onto Kafka topics through the same produce capability.Fanout with the Fetch CapabilityStream a Kafka topic back out to gRPC clients, with optional key and header filters, the reverse of produce.Calling Back into gRPCReplay Kafka request messages back into a live gRPC service and write the response to the reply-to topic.

SSE from Kafka

Fan a Kafka topic out to browser clients as Server-Sent Events, no WebSocket server or fanout service to run.

Reliable Delivery & ReconnectsResume a dropped stream from the client's last-seen offset automatically, no client-side bookkeeping required.Tombstones as Delete EventsA Kafka tombstone arrives at the client as a delete event, identifying the removed key from the event id.

Secure Broker Connection

Authenticate and encrypt Kafka Gateway's own connection to your brokers, no credentials baked into application code.

SASL/PLAINAuthenticate to Kafka brokers with a SASL/PLAIN username and password.SASL/SCRAMAuthenticate to Kafka brokers with SASL/SCRAM, a salted challenge-response mechanism.SASL/OAuthBearerAuthenticate to Kafka brokers with an OAuth 2.0 bearer token sourced from a guard.TLSEncrypt the connection between Kafka Gateway and your Kafka brokers.Mutual TLSAuthenticate Kafka Gateway to your brokers with a mutual TLS client certificate.

Schema Governance

Catch a malformed message before it reaches the broker or the client, no bespoke validation service.

ValidateReject a Kafka message key or value that doesn't conform to a schema or type, on produce or on fetch.TransformPresent one format to clients while storing another on the Kafka topic, using a model's view transform.Schema RegistryRegister local or remote catalogs so Kafka Gateway can resolve schemas by subject, topic, or ID.Schema EnforcementAdd type structure to message keys and values, from primitives to schema-backed Avro, Protobuf, or JSON.

Multi-Tenant Kafka

Share one physical Kafka cluster across teams or tenants, each with its own topics, ACLs, and quotas.

Virtual Kafka ClustersPlusMap a virtual cluster onto a shared physical cluster entirely through config, its own bootstrap host, topics, ACLs, and quotas.Dynamic Topic AliasesPlusGive every client the same external topic name while routing each one to its own internal topic, based on its authenticated identity.

Observability

See every protocol Kafka Gateway mediates, with no instrumentation in your clients or your brokers.

MetricsCollect HTTP, gRPC, and stream metrics for every protocol Kafka Gateway mediates, plus internal message-handler metrics.ExportersShip metrics and log events to Prometheus, OpenTelemetry, or AWS CloudWatch.LogsGet named, structured events for every component Kafka Gateway raises, ready to grep or ship to a log pipeline.

Use Cases

Secure Public Access

Expose private Kafka clusters securely over the public internet with TLS, JWT auth, and schema validation at the edge.

TLSJWTmTLS

Secure Private Access

Give internal services authenticated access to Kafka across VPCs and accounts without exposing brokers.

PrivateVPCmTLS

Virtual Kafka Clusters

Partition a single Kafka cluster into isolated virtual clusters with their own namespaces and access controls.

Multi-tenantIsolation

IoT Ingestion

Connect IoT devices over MQTT directly to Kafka. No separate broker required.

MQTTIoTKafka

Browser Streaming

Stream Kafka events to web clients over SSE. No WebSocket server required.

SSEBrowserStreaming

Web Streaming

Serve Kafka-backed real-time feeds to web and mobile apps.

SSEWebSocket

Why Zilla

Every Protocol is a First-Class Binding

HTTP, MQTT, gRPC, SSE, and WebSocket are native stream types inside Zilla's engine, not adapters bolted on. The same routing, auth, and observability primitives apply uniformly across all protocols.

Spec-Driven by Default

Routing, validation, and security config are generated directly from OpenAPI and AsyncAPI specs. No manual mapping between spec and gateway config.

Schema Validation at the Edge

Avro, Protobuf, and JSON Schema validation runs at the gateway before messages reach the broker. Supports Apicurio, Confluent, Karapace, and AWS Glue out of the box.

Auth at the Infrastructure Layer

JWT guards, mTLS, and Kafka SASL are enforced at the binding level before traffic reaches the broker. No auth logic in application code, no per-service wrappers.

Multi-Tenancy Without Extra Clusters

Virtual clusters partition one Kafka cluster into isolated namespaces with per-tenant topic visibility and access controls. No extra brokers, no separate deployments.

Zero-Instrumentation Observability

Metrics and logs export to Prometheus, OpenTelemetry, or AWS CloudWatch with no instrumentation required in the application or the Kafka producers and consumers.

Stateless and Kubernetes-Native

Zilla carries no per-connection state between restarts. Deploy with Helm, auto-reconfigure on ConfigMap changes, and scale horizontally as a standard Kubernetes deployment.