# Confluent Cloud Gateway Overview Confluent Cloud Gateway (Confluent Gateway) is a cloud-native Kafka proxy solution designed to simplify client connectivity, secure access, and cluster management across distributed Kafka environments. It provides a stable, protocol-aware entry point for Kafka clients, abstracting away complex broker lists, inconsistent security settings, and the operational overhead of managing direct client-to-cluster connections. When deployed between clients and Kafka clusters, Confluent Gateway acts as an intelligent routing layer. As a self-managed solution, it gives you full control over deployment, configuration, and operations, while integrating seamlessly with your existing streaming infrastructure. Confluent Gateway abstracts the complexity of Kafka connectivity, making modern, secure, and highly available Kafka operations possible for enterprise environments. Confluent Gateway enables the following use cases: * Future migrations of on-premises clients to Confluent Cloud without client changes. * On-premises disaster recovery switchover from one unhealthy cluster to another healthy cluster without client changes, achieving a significant reduction in recovery time. * Secure external partner access for a private cluster. * Custom domains for your Kafka listeners. For example configuration scenarios, see [Confluent Gateway GitHub repository](https://github.com/confluentinc/gateway-images/tree/master/examples). ## High-level architecture When Kafka client applications connect to the Confluent Gateway using the Kafka protocol, the Confluent Gateway intercepts and routes these protocol messages securely to the appropriate upstream Kafka clusters. The Confluent Gateway rewrites Kafka responses (including metadata and broker addresses) to present only virtualized endpoints to clients, ensuring that cluster changes remain seamless and transparent to applications.  * **Routes:** Confluent Gateway endpoints where client applications connect to stream data. Confluent Gateway uses routes to create an abstraction layer between client applications and Kafka clusters. These routing abstractions help decouple the client applications and Kafka brokers. * **Streaming domains:** Logical representations of your Kafka clusters at the Confluent Gateway. * **Policies:** Governance and client behavior rules that Confluent Gateway enforces on records flowing through a route, such as schema validation and encryption rules. You define policies once and Confluent Gateway applies them centrally to every client, without reconfiguring individual applications or brokers. With Confluent Gateway, you need to configure each route with a streaming domain. Client applications then connect to routes instead of directly connecting to brokers’ listener endpoints. For every payload request addressed to a particular route, Confluent Gateway will automatically forward the request to a Kafka cluster based on the route’s associated streaming domain. By changing the mapping of a route to a different streaming domain, central platform teams can independently and centrally change the backing Kafka cluster infrastructure for migrations and disaster recovery. If you enable [centralized governance](governance/gateway-governance.md#gateway-governance), Confluent Gateway also validates each record against Confluent Cloud Schema Registry based on the configured enforcement level, then forwards it, rejects it, or applies data contract rules. On the fetch path, Confluent Gateway applies data contract rules, such as decryption, before returning records to the client. ## Supported features The following features are supported in the current release of Confluent Gateway: * Virtual bootstrap and broker endpoints for simplified client setup * Transparent protocol proxying (no client-side changes required) * Multiple authentication methods, identity pass-through, and authentication swapping * Secure credential storage and retrieval * Metrics, tracing, and simplified troubleshooting * Compatibility with Kafka protocol versions 3.x and 4.x * Centralized Governance Enforcement (Early Access): Validate schemas and enforce data contracts against Confluent Cloud Schema Registry so that only compliant records reach your Kafka clusters. For more information, see [Centralized governance](governance/gateway-governance.md#gateway-governance). * No support for legacy protocol versions or sidecar deployment in the current release * Confluent Gateway connects to Confluent Cloud Schema Registry as a client for governance validation but does not proxy client-to-Schema Registry HTTP/REST traffic ## System resource requirements The following are the recommended system resources for Confluent Gateway: * CPU and memory: * Minimum: 2 vCPUs, 4 GB RAM * Recommended: 4 vCPUs, 8 GB RAM * Network throughput: 45 MB/sec of sustained workload for a 1-Gigabit link (1 Gbps) * Storage: 10 GB of disk space ## Get started To provision and configure Confluent Gateway, refer to the detailed guides available for both Docker and Confluent for Kubernetes (CFK) deployments. The documentation includes step-by-step installation, configuration for streaming domains and routes, and security recommendations. * [Configure and Deploy](gateway-deploy-overview.md#gateway-deploy-overview) * [Migrate Kafka Clusters](gateway-migrate.md#gateway-client-switchover) * [Set up Network Isolation and Custom Domains](gateway-custom-domains.md#gateway-custom-domains) * [Enforce Centralized Governance](governance/gateway-governance.md#gateway-governance)