Confluent Developer Marketplace Get started
  1. Home
  2. Cloud
  3. Confluent Cloud Clusters
  4. Connect Confluent Platform Components to Confluent Cloud
  5. Confluent Cloud Gateway

What is Confluent Cloud Gateway?

Confluent Cloud Gateway (Confluent Gateway) is a cloud-native Kafka proxy solution designed to simplify client connectivity, secure access, and cluster management across distributed Kafka environments. It provides a stable, protocol-aware entry point for Kafka clients, abstracting away complex broker lists, inconsistent security settings, and the operational overhead of managing direct client-to-cluster connections.

When deployed between clients and Kafka clusters, Confluent Gateway acts as an intelligent routing layer. As a self-managed solution, it gives you full control over deployment, configuration, and operations, while integrating with your existing streaming infrastructure.

Confluent Gateway abstracts the complexity of Kafka connectivity, making modern, secure, and highly available Kafka operations possible for enterprise environments.

Note

Confluent Cloud Gateway and Confluent Private Cloud Gateway share the same underlying proxy technology, but are separate, independently licensed products. This documentation focuses on Confluent Cloud Gateway, which connects self-managed Kafka clients and clusters to Confluent Cloud. For standalone private cloud deployments that do not connect to Confluent Cloud, see the Confluent Private Cloud Gateway documentation.

Why use Confluent Gateway?

Confluent Gateway enables the following use cases:

  • Future migrations of on-premises clients to Confluent Cloud without client changes.

  • on-premises disaster recovery switchover from an unhealthy self-managed cluster to Confluent Cloud without client changes, achieving a significant reduction in recovery time.

  • Secure external partner access for a private cluster.

  • Custom domains for your Kafka listeners.

For example configuration scenarios, see Confluent Gateway GitHub repository.

How Confluent Gateway routes and secures Kafka traffic

When Kafka client applications connect to the Confluent Gateway using the Kafka protocol, the Confluent Gateway intercepts and routes these protocol messages securely to the appropriate upstream Kafka clusters. The Confluent Gateway rewrites Kafka responses including metadata and broker addresses to present only virtualized endpoints to clients, ensuring that cluster changes remain transparent to applications.

../../_images/CC-Gateway-Intro.png

  • Routes: Confluent Gateway endpoints where client applications connect to stream data.

    Confluent Gateway uses routes to create an abstraction layer between client applications and Kafka clusters. These routing abstractions help decouple the client applications and Kafka brokers.

  • Streaming domains: Logical representations of your Kafka clusters at the Confluent Gateway.

  • Policies: Governance and client behavior rules that Confluent Gateway enforces on records flowing through a route, such as schema validation and encryption rules. You define policies once and Confluent Gateway applies them centrally to every client, without reconfiguring individual applications or brokers.

With Confluent Gateway, you need to configure each route with a streaming domain. Client applications then connect to routes instead of directly connecting to brokers’ listener endpoints. For every payload request addressed to a particular route, Confluent Gateway automatically forwards the request to a Kafka cluster based on the route’s associated streaming domain.

By changing the mapping of a route to a different streaming domain, central platform teams can independently and centrally change the backing Kafka cluster infrastructure for migrations and disaster recovery.

If you enable centralized governance, Confluent Gateway also validates each record against Confluent Cloud Schema Registry based on the configured enforcement level, then forwards it, rejects it, or applies schema rules. On the fetch path, Confluent Gateway applies schema rules, such as decryption, before returning records to the client.

Supported protocols, features, and limitations

The following features are supported in the current release of Confluent Gateway:

  • Virtual bootstrap and broker endpoints for simplified client setup

  • Transparent protocol proxying (no client-side changes required)

  • Multiple authentication methods, identity pass-through, and authentication swapping

  • Secure credential storage and retrieval

  • Metrics, tracing, and simplified troubleshooting

  • Compatibility with Kafka protocol versions 3.x and 4.x

  • Centralized Governance Enforcement (Early Access): Validate schemas and enforce schema rules against Confluent Cloud Schema Registry so that only compliant records reach your Kafka clusters. For more information, see Centralized governance.

The current release of Confluent Gateway has the following limitations:

  • No support for legacy protocol versions or sidecar deployment in the current release

  • Confluent Gateway connects to Confluent Cloud Schema Registry as a client for governance validation but does not proxy client-to-Schema Registry HTTP/REST traffic

Get started

To provision and configure Confluent Gateway, see the detailed guides available for both Docker and Confluent for Kubernetes (CFK) deployments. The documentation includes step-by-step installation, configuration for streaming domains and routes, and security recommendations.