Confluent + Conduktor
Make your Confluent investment work harder with enterprise governance, data quality enforcement, and wire-level security.
Trusted by
Policies enforced at the protocol level-clients can't bypass them.
Encrypt any payload at the wire-plain JSON included.
Catch bad data before it breaks downstream systems.
Onboard teams without bottlenecks-or bad configurations.
Compose permission sets instead of picking from a fixed list of roles.
Stop bad client configurations at the wire.
A UI developers actually want to use.
One interface for Cloud, Platform, and hybrid.
Share data with partners without replication.
Confluent Stream Governance runs in client serializers. If a producer uses a standard Kafka serializer, data quality rules don't apply. Stream processors like ksqlDB and Flink bypass these rules entirely.
Conduktor Gateway intercepts at the wire:
- Every message passes through-no bypass possible
- Works with any Kafka client, any serializer
- Encryption, masking, validation enforced before data hits the broker
Confluent CSFLE runs on Schema Registry data contracts: a registered schema subject, a tag on the field, an encryption rule. Avro, JSON Schema or Protobuf only, string and bytes fields only, plus library changes in every producer and consumer.
Conduktor Gateway encrypts at the protocol level, no schema required:
- Full payload on the key, value or headers-structured or not
- Field-level on Avro, Protobuf and JSON, fields listed in config or tagged in your schema
- 5 KMS backends (AWS, Azure, GCP, HashiCorp Vault, Fortanix)
- Selective decryption by role-AI sees data, support sees masked
- Zero producer code changes (one customer saved $380K/year)
See the full data protection overview.
Validate payloads with or without Schema Registry:
- Field-level rules: formats, ranges, patterns, required fields
- CEL expressions for cross-field validation
- Dead-letter routing for violations with full error context
- Gradual migration path: schema-less to schema-ful
Platform teams define policies; developers move fast within them:
- CEL-based resource policies enforce naming, partitions, retention
- Topic creation guardrails prevent misconfigurations
- Request/approve workflows with automatic validation
- Cost attribution by team and application
Confluent RBAC starts from predefined roles: you can't create one or change what it grants, and bindings are delete-and-recreate.
Conduktor Console has no role catalog. You pick the operations:
- Per resource: topics, consumer groups, subjects, connectors, clusters
- Console features too-API keys, certificates, masking policies, Self-service
- Scoped by exact name, prefix or wildcard, on one cluster or all
- Assigned to users or IdP-mapped groups
Console RBAC covers what people do through Conduktor. Self-service turns application ownership into Kafka ACLs, or Confluent role bindings if you'd rather enforce there.
Enforce best practices without code changes:
- Require compression (GZIP, LZ4, ZSTD)-block uncompressed traffic
- Enforce acks=-1 for durability guarantees
- Limit offset commits per minute to prevent commit storms
- Connection rate limiting to protect brokers
Control Center is ops-centric. Console is built for developers:
- Explore and filter messages visually
- Self-serve topic creation with guardrails
- Schema browser with compatibility tracking
- Fast, modern interface praised by dev teams
Production on Confluent Cloud. Staging on Platform. DR on MSK.
Conduktor Console manages all environments with:
- Unified RBAC across clusters
- Consistent policies everywhere
- Single audit trail for compliance
Cluster Linking replicates data-doubling infrastructure cost.
Conduktor provides:
- Governed access without data duplication
- Chargeback for partner billing
- Full audit trail and access control
Wire-Level Enforcement
Policies enforced at the protocol level. Clients can't bypass-unlike client-side rules.
Encryption, Schema Optional
Full payload or field-level, on plain JSON or Avro. 5 KMS backends, zero code changes, selective decryption by role.
Data Quality
Validate payloads with or without schemas. CEL rules, dead-letter routing, alerts.
Client Enforcement
Require compression, acks, idempotence at the wire. No code changes.
Self-Service Catalog
Request/approve workflows with CEL-based resource policies and guardrails.
Developer-First UI
Explore messages visually, self-serve with guardrails, modern interface developers love.
GitOps Everything
Terraform provider for clusters, RBAC, policies, data quality, self-service-not just Kafka resources.
Virtual Clusters
Logical multi-tenancy on shared infrastructure. No cluster proliferation.
Composable RBAC
No fixed role catalog. Pick the operations, scope them by prefix or wildcard, assign to users or IdP groups.
No artificial limits
Confluent Cloud enforces quota limits that require support escalation at scale. Conduktor removes the ceiling.
Confluent Cloud limits API keys to 1,000 per org, role bindings to 500-25,000 per cluster, and service accounts to 1,000 per org. Conduktor has no such limits.
| Resource | Confluent Cloud | Conduktor |
|---|---|---|
| API keys | 1,000 per org, 50–2,000 per cluster | Unlimited |
| Role bindings | 500 per cluster (25K on Dedicated) | Unlimited |
| Service accounts | 1,000 per org | Unlimited |
Example: A single Kafka Streams application creates ~6 role bindings. At 500 per cluster (Standard/Enterprise), you hit the ceiling at ~80 applications. Even Dedicated clusters cap at ~4,000. A microservices architecture with 1,000+ services? You'll exhaust API keys and service accounts. Conduktor provides virtual clusters with unlimited service accounts and RBAC bindings.
A major payroll provider avoided infrastructure costs by encrypting at the wire, not duplicating data.
New teams go from Kafka request to producing events-down from weeks.
Read more customer stories
Does Conduktor work with both Confluent Cloud and Confluent Platform?
Yes. Conduktor connects to Confluent Cloud (Dedicated, Standard, Basic) and self-managed Confluent Platform clusters. Manage all cluster types from a single interface.
What's the difference between wire-level and client-side enforcement?
Confluent Stream Governance data quality rules run in client serializers-if a producer uses a standard Kafka serializer, those rules don't apply. Stream processors like ksqlDB and Flink bypass them entirely. Conduktor Gateway intercepts at the wire: every message passes through, no bypass possible, works with any client.
Does Conduktor encryption require Schema Registry?
No. Confluent CSFLE does: a registered schema subject, a tag on the field, an encryption rule in the data contract, and only string and bytes fields in Avro, JSON Schema or Protobuf. Conduktor Gateway encrypts at the wire, so plain JSON with no schema anywhere behaves like Avro. Fields are picked from a list in the interceptor config, or from schema tags if you have them.
Can I encrypt a whole message, not just fields?
Yes. Full payload encryption covers the record key, value or headers-what you want when the whole message is sensitive or the payload shape varies. You can layer both: field-level first, full payload as a fallback for anything left. Confluent CSFLE is field-scoped by design.
How does Conduktor RBAC compare to Confluent's roles?
Confluent RBAC starts from predefined roles you can't create or modify, with bindings that are delete-and-recreate. Conduktor Console has no catalog: you pick the operations per resource (topics, consumer groups, subjects, connectors, clusters) and per Console feature, scoped by name, prefix or wildcard, on one cluster or all. Console RBAC covers actions through Conduktor; Self-service handles the broker side via Kafka ACLs or Confluent role bindings.
How does selective decryption work?
Conduktor Gateway encrypts fields at the wire, then selectively decrypts based on consumer identity. AI team with decrypt permission sees salary: $95,000. Support team without permission sees: XXXXX. Same topic, same data, different views. Zero producer code changes.
What can I manage with Terraform?
Conduktor's Terraform provider covers more than just Kafka resources: cluster connections, RBAC policies, topic policies, data quality rules, self-service catalog, applications, and Conduktor Gateway interceptors. GitOps your entire governance layer, not just topics.
How does data quality validation work without Schema Registry?
Conduktor Gateway validates payloads using CEL expressions and field-level rules-independent of Schema Registry. You can enforce formats, ranges, and required fields on JSON payloads without schemas. This enables gradual migration from schema-less to schema-ful architectures.
What client configurations can Conduktor enforce?
Compression type (require GZIP/LZ4/ZSTD), acks mode (enforce acks=-1), idempotence, offset commit rate limits, connection rate limits, and client ID naming conventions. All enforced at the wire level-no application code changes.
What are the limits on Conduktor vs Confluent Cloud?
Confluent Cloud limits: 1,000 API keys per org, 500 role bindings per cluster (25K on Dedicated), 1,000 service accounts per org. Conduktor has no such limits-virtual clusters support unlimited service accounts and RBAC bindings.
What are virtual clusters?
Logical isolation on shared infrastructure. Each team gets their own namespace with separate service accounts, topic prefixes, and rate limits-without spinning up separate Kafka clusters. Reduces cost while maintaining isolation.
How is Console different from Control Center?
Control Center is ops-centric with a steep learning curve. Console is developer-first: explore messages visually, self-serve topic creation with guardrails, schema browser with compatibility tracking. Developers actually want to use it.
Can I use Confluent Schema Registry with Conduktor?
Yes. Conduktor integrates natively with Confluent Schema Registry for schema validation, evolution tracking, and compatibility enforcement. Data quality rules can work alongside or independent of Schema Registry.
Does Conduktor require changes to my Confluent setup?
No. Conduktor connects via standard Kafka protocols. No configuration changes to your Confluent clusters.
Is Conduktor a replacement for Confluent?
No. Conduktor is complementary. Confluent handles your Kafka infrastructure; Conduktor adds enterprise governance, data quality, and security capabilities on top.
How do I encrypt Kafka messages without code changes?
Conduktor Gateway encrypts fields at the wire level using your KMS (AWS, Azure, GCP, HashiCorp Vault, Fortanix). Producers send plaintext; Gateway encrypts before the message hits the broker. Consumers with permission see decrypted data; others see masked values. Zero application code changes required.
Running Kafka on Confluent?
Whether you're using Confluent Cloud, Confluent Platform, or a hybrid setup, our team can help you design the right governance architecture for your workloads. See our architecture overview for deployment options.