KONG-33 Spike - Investigate Kong Alternatives

https://folio-org.atlassian.net/browse/KONG-33

Executive Summary

• Scope: Assesses enterprise-ready open-source API gateways (excluding Kong) with migration guidance for teams planning a Kong exit.

• Gateways Evaluated: Apache APISIX, Tyk Gateway, Spring Cloud Gateway, Traefik, KrakenD, Envoy Gateway.

• Criteria: License, operational and routing depth, clustering, admin UI/interfaces, FIPS compliance, feature parity, advanced capabilities, community health, and release tempo.

Feature Comparison Table

Advanced Features Table

Detailed Analysis

Apache APISIX

Overview:
Enterprise-ready OSS API gateway with real-time config, FIPS compliance, extensive plugins, high performance, and strong community.

Management & APIs:

• Admin UI: Yes (separate, web dashboard)

• Admin API: RESTful, full CRUD, plugin and resource lifecycle

• API Features: Bulk CRUD, plugin/versioning, health/status endpoints

Configuration Management:

• Storage: etcd (distributed)

• Hot Reload: Yes (atomic cluster-wide propagation)

Routing Capabilities:

• Path Matching: exact, prefix, param (/foo/:id), wildcard

• Routing Limitations:

  • Path regex must be configured with “vars” on uri

  • Cannot match encoded slash (%2F) in parameter (this is an nginx restriction)

Advanced Features:

• Rate Limiting: Token, leaky bucket, fixed window (per-plugin)

• Circuit Breaker: Plugin

• Authentication: JWT, OIDC, LDAP, API Key, Basic (plugins)

• Authorization: RBAC, plugin

Observability:

• Logging: 15+ plugins (JSON/syslog/HTTP/Kafka, etc.)

• Metrics: Prometheus, DataDog

• Tracing: OpenTelemetry, Jaeger, SkyWalking

Performance:

• RPS: 23,000+

• P99 Latency: <1ms

Community:

• GitHub Stars: 14,000+

• Release Cycle: Bi-weekly (rapid, active OSS cadence)

PROS:

• OSS FIPS 140-2 support

• Real-time hot reload

• Advanced plugin/obs support

• Java and Lua extensibility

CONS:

• Multi-tenancy OSS via plugins only

• No regex route, %2F path issue

• Admin UI is separate deploy

• Lower plugin count vs. Tyk

Tyk Gateway

Overview:
Polished Go gateway suited for organizations needing OSS UI, multi-tenancy, and powerful routing, with commercial FIPS/enterprise.

Management & APIs:

• Admin UI: Yes (built-in, web dashboard)

• Admin API: RESTful, comprehensive (analytics, orgs, CRUD)

• API Features: Bulk ops, analytics, policy mgmt, inherited versioning

Configuration Management:

• Storage: File, MongoDB, Redis

• Hot Reload: Yes (API/UI/file scope)

Routing Capabilities:

• Path Matching: exact, prefix, full regex, wildcard, parameterized

• Routing Limitations:

  • Clustering needs DB backend

  • No JVM/Java plugin model

Advanced Features:

• Rate Limiting: Token/leaky/fixed window, burst (policies)

• Circuit Breaker: Dashboard-configurable, threshold/policy

• Authentication: JWT, OAuth2, OIDC, API Key, HMAC

• Authorization: RBAC/JWT/policy

Observability:

• Logging: JSON, syslog

• Metrics: Prometheus, StatsD

• Tracing: OpenTelemetry, Jaeger

Performance:

• RPS: 12,000+

• P99 Latency: <10ms

Community:

• GitHub Stars: 9,500+

• Release Cycle: Monthly (regular feature pace)

PROS:

• Rich UI/analytics built-in

• Native OSS multi-tenancy

• Regex routing, flexible plugins

• Top developer UX and docs

CONS:

• FIPS only in commercial

• Clustering needs DB (infra cost)

• No JVM plugin support

• Lower scale than APISIX/Envoy

Spring Cloud Gateway

Overview:
Best for Spring/Java organizations; code-centric API gateway, high extensibility, full Spring cloud integration, ops via Java.

Management & APIs:

• Admin UI: No (health/metrics via Actuator)

• Admin API: Spring REST endpoints, Actuator

• API Features: Health/metrics, dynamic route mgmt via config/actuator

Configuration Management:

• Storage: Git, file, Spring Config Server

• Hot Reload: Yes (Spring Cloud bus refresh)

Routing Capabilities:

• Path Matching: exact, prefix, full regex

• Routing Limitations:

  • No web UI/config for non-Java teams

  • Clustering is custom build

Advanced Features:

• Rate Limiting: Plugin/micrometer

• Circuit Breaker: Plugin (Resilience4j)

• Authentication: Spring Security (all major)

• Authorization: RBAC/ABAC (Spring)

Observability:

• Logging: Logback, JSON

• Metrics: Micrometer, Prometheus

• Tracing: Sleuth, OpenTelemetry

Performance:

• RPS: 8,000+

• P99 Latency: <15ms

Community:

• GitHub Stars: 4,700+

• Release Cycle: Quarterly (aligned with Spring ecosystem)

PROS:

• Deep Java/Spring extensibility

• Full regex/programmatic routing

• Spring Cloud native

• Good observability/plugins

CONS:

• No web UI / ops for non-Java teams

• No OSS multi-tenancy

• Moderate performance/JVM overhead

• Clustering/config are “build it” not plug-and-play

Traefik

Overview:
Container-native, automatic config, best for K8s/events-driven infra, limited admin UI (status only), excels in simplicity/scalability.

Management & APIs:

• Admin UI: Status dashboard (monitoring only)

• Admin API: HTTP (dynamic config, status)

• API Features: Live status, route health

Configuration Management:

• Storage: File, K8s CRD, labels (event-driven)

• Hot Reload: Yes (instant, event scope)

Routing Capabilities:

• Path Matching: exact, prefix, wildcard, partial regex

• Routing Limitations:

  • No config/admin UI for management

  • Only basic multi-tenancy possible

Advanced Features:

• Rate Limiting: Middleware/plugins

• Circuit Breaker: Middleware

• Authentication: OAuth2 plugin, JWT, Key, Basic

• Authorization: Custom (middleware)

Observability:

• Logging: JSON/logf

• Metrics: Prometheus, DataDog, StatsD

• Tracing: Jaeger, Zipkin

Performance:

• RPS: 10,000+

• P99 Latency: <8ms

Community:

• GitHub Stars: 50,000+

• Release Cycle: Monthly (very active, huge user base)

PROS:

• Leading K8s/Cloud integration

• Easy auto-reload/config

• Large community and support

• Lightweight/stateless

CONS:

• No admin UI for configuration

• Not a full API gateway (proxy focus)

• Manual multi-tenancy/config

• Lacks advanced API mgmt

KrakenD

Overview:
For API aggregation/fan-in use cases, config-as-code, high performance, minimal UI, limited service discovery and plugins.

Management & APIs:

• Admin UI: None (file/config only)

• Admin API: REST/info (routing, telemetry)

• API Features: Swagger support, hot reload requires redeploy

Configuration Management:

• Storage: JSON file

• Hot Reload: No (restart required)

Routing Capabilities:

• Path Matching: exact, prefix, wildcard

• Routing Limitations:

  • Limited route pattern matching options

  • No web/admin UI

Advanced Features:

• Rate Limiting: Plugin, simple window

• Circuit Breaker: External/middleware

• Authentication: JWT, API key, plugin

• Authorization: Middleware

Observability:

• Logging: JSON/syslog

• Metrics: Prometheus/InfluxDB

• Tracing: Jaeger/Zipkin

Performance:

• RPS: 20,000+

• P99 Latency: <2ms

Community:

• GitHub Stars: 6,000+