Kafka Gateway
Gateway
Expose Kafka topics over HTTP, MQTT, gRPC, SSE, and WebSocket without custom code. One stateless runtime: protocol mediation, auth, and schema validation built in.
Capabilities
Translate HTTP, MQTT, gRPC, SSE, and WebSocket to and from Kafka. No adapters or custom code required.
Generate routing, validation, and security config directly from OpenAPI and AsyncAPI specs.
Validate messages against Avro, Protobuf, or JSON schemas. Works with Apicurio, Confluent, Karapace, and AWS Glue.
Enforce JWT guards, mTLS, and Kafka SASL at the edge before traffic reaches the broker.
Export metrics and logs to Prometheus, OpenTelemetry, or AWS CloudWatch. No instrumentation required.
Partition one Kafka cluster into isolated namespaces with per-tenant topic visibility and access controls.
Use Cases
Secure Public Access
Expose private Kafka clusters securely over the public internet with TLS, JWT auth, and schema validation at the edge.
Secure Private Access
Give internal services authenticated access to Kafka across VPCs and accounts without exposing brokers.
Virtual Kafka Clusters
Partition a single Kafka cluster into isolated virtual clusters with their own namespaces and access controls.
IoT Ingestion
Connect IoT devices over MQTT directly to Kafka. No separate broker required.
Browser Streaming
Stream Kafka events to web clients over SSE. No WebSocket server required.
Web Streaming
Serve Kafka-backed real-time feeds to web and mobile apps.
Why Zilla
Every Protocol is a First-Class Binding
HTTP, MQTT, gRPC, SSE, and WebSocket are native stream types inside Zilla's engine, not adapters bolted on. The same routing, auth, and observability primitives apply uniformly across all protocols.
Spec-Driven by Default
Routing, validation, and security config are generated directly from OpenAPI and AsyncAPI specs. No manual mapping between spec and gateway config.
Schema Validation at the Edge
Avro, Protobuf, and JSON Schema validation runs at the gateway before messages reach the broker. Supports Apicurio, Confluent, Karapace, and AWS Glue out of the box.
Auth at the Infrastructure Layer
JWT guards, mTLS, and Kafka SASL are enforced at the binding level before traffic reaches the broker. No auth logic in application code, no per-service wrappers.
Multi-Tenancy Without Extra Clusters
Virtual clusters partition one Kafka cluster into isolated namespaces with per-tenant topic visibility and access controls. No extra brokers, no separate deployments.
Zero-Instrumentation Observability
Metrics and logs export to Prometheus, OpenTelemetry, or AWS CloudWatch with no instrumentation required in the application or the Kafka producers and consumers.
Stateless and Kubernetes-Native
Zilla carries no per-connection state between restarts. Deploy with Helm, auto-reconfigure on ConfigMap changes, and scale horizontally as a standard Kubernetes deployment.