Conduktor

Editor’s note: This Conduktor review is based on my hands-on test of Conduktor Console 1.48 and Gateway 3.22 in October 2026. I weighed pricing and tier gating against Console workflows, governance, Gateway operations, monitoring, and MCP.

Quick verdict: I recommend Conduktor for platform teams needing ownership and approvals across product teams on Confluent, AWS MSK, Redpanda, or Aiven. My reservations are self-hosting with external PostgreSQL, $1,200 annual Team seats, and quote-only Gateway Enterprise with a 3-cluster minimum.

Console is a web UI; Conduktor Gateway is a Kafka-protocol proxy for Kafka 2.7+. Among the streaming platforms in the directory, I consider Conduktor a governance layer, not a broker.

In this Conduktor review, I’ll take a closer look at Conduktor’s pricing, features, and setup, so you can see exactly whether Community is enough or paid governance earns its price.

Key Takeaways

• Community Console is free with no time limit for up to 50 users and 3 clusters, including SQL, live tail, SSO/LDAP, and MCP.
• Team costs $125 per seat monthly or $1,200 annually, bought online. Console Enterprise and Gateway Enterprise require quotes; Gateway licensing is per cluster, with a 3-cluster minimum.
• Every Console tier is self-hosted, needs PostgreSQL 13+, and has no SaaS option.
• Community monitoring covers the last hour; history, alerts, masking, and the activity log require Team.
• Gateway Enterprise includes Virtual Clusters; encryption and masking require the Protect add-on, while failover requires the DR & Failover add-on. Clients change only bootstrap.servers. Key managers include Vault, AWS, Azure, GCP, and Fortanix.

Pros and Cons

How Much Does Conduktor Cost?

Console has 3 tiers and Gateway has 2; only Community and Team Edition carry public prices. I separate Console’s seat bill from Gateway’s cluster licensing because Team does not automatically buy encryption or failover.

• Console Community (free): My starting recommendation for up to 50 users and 3 clusters, with no license key or time limit. It includes Kafka operations, SQL queries, live tail, SSO through OIDC/SAML, LDAP, REST API, CLI, and MCP. Monitoring stops at the last hour; support includes guides, community Slack, and best-effort email.
• Console Team Edition ($125 per seat monthly or $1,200 per seat annually): For platform teams managing ownership. Purchase online through Stripe and receive the license by email. Team adds unlimited clusters, group-level RBAC, approval workflows, topic policy enforcement, and Chargeback. It also includes unlimited masking, custom alerts, and activity log, plus DLQ reprocessing and replay, connector auto-restart, and Standard Support by email during business hours.
• Console Enterprise (quote): For organizations requiring volume pricing, dedicated customer success, custom contracts, or Gateway bundling. Silver Support is included; Gold 24/7 is optional. Only Enterprise includes a production uptime SLA, which matters more to my recommendation than account-management extras.
• Gateway Community (free): For cross-network Kafka access across VPCs or clouds, with a single egress point. Authentication and authorization stay with the Kafka provider. It requires a license key to start and includes neither governance nor encryption.
• Gateway Enterprise (quote, per cluster): Requires a 3-cluster minimum. It includes Schema Registry Proxy, Virtual Clusters, topic concentration, aliases, Partner Zones, SQL Topics, caching, large messages, centralized authentication, and an activity trail. DR & Failover and Protect are separate paid add-ons.
• Schema Registry Proxy (quote, per cluster): Also sold separately for subject-level permissions derived from ACLs or Console ownership, OAuth2/OIDC, and OpenTelemetry traces. It became production-ready in October 2026.

Plan	Price	Licensing	Headline features
Console Community	Free	Up to 50 users and 3 clusters	Kafka operations; last hour of metrics
Console Team Edition	$125 per seat monthly or $1,200 per seat annually	Per seat; unlimited clusters	Ownership, policies, Chargeback, alerts
Console Enterprise	Quote	Custom contract; volume pricing	Custom SLA; Gateway bundling
Gateway Community	Free	License key required	Cross network access only
Gateway Enterprise	Quote per cluster	Minimum 3 clusters	Proxy governance; security and DR add ons sold separately

Terraform provider eligibility conflicts: Conduktor includes it in its Community offer but marks it as paid in the feature matrix.

Is Conduktor Good Value for Money?

• Good fit: I favor Team for 5 to 15 platform engineers needing approvals and Chargeback across more than 3 clusters. Annual seat costs run from $6,000 to $18,000.
• Less convincing fit: I recommend skipping Team for 50 engineers needing only topic browsing. That costs $60,000 annually; Kpow Enterprise starts at $4,500 per cluster with 100 users, while Lenses Team starts at $4,000 annually for 15 users on one cluster.
• Budget priority: I recommend exhausting Community’s SQL, live tail, and SSO first. Kafbat UI and AKHQ are Apache 2.0 alternatives beyond the 3-cluster cap.

Reviewer’s Notes: I recommend Community within 3 clusters and Team for engineers responsible for governance. I recommend discussing Enterprise when Gateway becomes necessary: cluster licensing, the 3-cluster minimum, and separate add-ons already require a sales conversation.

My Experience With Conduktor

Starting the Quick-Start Stack

I ran the Docker Compose quick start: curl -L https://releases.conduktor.io/quick-start -o docker-compose.yml && docker compose up -d --wait. I opened Console at localhost:8080 alongside a Redpanda broker, PostgreSQL, and a synthetic e-commerce data generator.

I left the license key unset for Community mode, without starting a time-limited trial. For production, I accounted for external PostgreSQL 13+, blob storage for monitoring, and Kafka 2.7.0+:

• Database: External PostgreSQL 13+ with backups and high availability.
• Monitoring: S3, GCS, or Azure blob storage, plus the separate conduktor-console-cortex image for Prometheus and Alertmanager, unless using external monitoring.
• Hardware: At least 2 cores, 3 GB RAM, and 5 GB disk; recommended capacity starts at 4 cores, 4 GB RAM, and 10 GB disk.
• Deployment: Docker or Kubernetes, with Helm charts available.

I also accounted for air-gapped operation: licenses verify locally, except AWS Marketplace licensing. Telemetry needs an allowed egress route to avoid harmless “Could not upload batch” log noise.

Connecting My First Cluster

I opened Settings > Clusters > Add cluster, starting with bootstrap servers and additional security properties. I reviewed the SASL_SSL and SCRAM-SHA-512 JAAS configuration options.

I checked the configuration-page permission boundary: only Admin group members or users with “Can manage Cluster configurations” can access it.

I checked the Console service account against these Kafka permissions:

• CLUSTER: DESCRIBE and DESCRIBE_CONFIGS.
• TOPIC (*): DESCRIBE, DESCRIBE_CONFIGS, and READ.
• GROUP (*): DESCRIBE and READ.

There is no dedicated read-only mode: omitting write ACLs restricts backend writes, while Console RBAC controls interface actions.

After bootstrap servers and security properties, I reached the Add cluster form’s optional Schema Registry, Kafka Connect, ksqlDB, and provider integrations:

• Schema Registry: Confluent, Confluent-compatible registries such as Karapace, or AWS Glue.
• Processing services: Kafka Connect and ksqlDB.
• Provider integrations: Confluent Cloud, Aiven, or Gateway.

Working With Topics and Consumer Groups

Topic names use case-insensitive substring matching, not wildcards or regular expressions.

I reviewed the additional topic-list controls:

• Internal topics: Hide names starting with an underscore.
• Kafka Streams topics: Hide repartition and changelog topics.
• Cleanup policy and labels: Narrow the topic list.
• Pagination: Choose 20, 50, or 100 rows per page.

I checked filter persistence per cluster in browser local storage. The data explorer combined SQL queries with live tail, production, export, and decoding:

• Inspect: JavaScript/JQ filters, SQL queries, and live tail.
• Move records: Produce messages or export data.
• Decode: JSON, Avro, Protobuf, and custom serializers.

I filtered consumer groups by name, labels, and state: Stable, Empty, Dead, Rebalancing, or Unknown. I sorted by name, state, overall lag, max lag time, and members. Group details expose per-partition lag, consume rate, and a time-lag estimate.

I checked Reset offsets with the Empty-or-Dead requirement in mind. I reviewed the available strategies:

• Earliest or latest: Move to either end of the available offsets.
• Specific offset or timestamp: Select the reset position.
• Shift by N: Move offsets by a numeric amount.

I reviewed scope selection for all partitions, specific topics, or topic-partitions. Preview compared current and proposed offsets before application.

Reviewer’s Notes: I consider substring-only topic filtering and the Empty-or-Dead reset requirement the main workflow traps. For teams accustomed to command-line consumer-group operations, I recommend planning the consumer stop and maintenance window before opening Reset offsets.

Governance: Self-service, Policies, Lineage and Chargeback

Paying $1,200 per seat annually makes more sense when Console replaces access-request coordination than when it merely displays records.

Self-service and Resource Policies

Self-service assigns topics to applications, with application groups holding distinct permissions. Since May 2026, those rights split into:

• Request access: Initiate access requests.
• Grant access: Approve access separately.
• Manage credentials: Manage API keys or service accounts.

I favor that separation because delegating access requests does not require delegating credential management. The Topic Catalog exposes:

• Ownership: The owning application and instance.
• Visibility: Public or Private status.
• Context: An editable topic description.

Topic and connector templates pre-fill creation forms. Self-service also supports prefixed topic access and transactional IDs, while Confluent Platform deployments can use role bindings instead of ACLs.

Cluster-wide resource policies arrived in January 2026; Self-service topic policies were deprecated in Console 1.46.0 in their favor in February 2026. Kafka Connect resource policies are manageable through the UI, and the Connect UI enforces RBAC.

Stream Lineage

Stream Lineage maps which applications and service accounts can read or write a topic. Its permission inputs are:

• Kafka ACLs
• Self-service permissions
• Confluent role bindings

I recommend the standard view for reviewing granted access, not live traffic, rather than proving that a consumer is currently reading; Live mode requires Gateway clusters.

Chargeback

Chargeback calculates costs at query time using configurable unit prices. I value grouping costs by cluster, application, or label rather than forcing every allocation through topic names.

Its 5 cost axes are:

• Storage: Dollars per GB per hour.
• Partitions: Dollars per partition per hour.
• Ingress: Dollars per GB.
• Egress: Dollars per GB.
• Kafka Connect: Dollars per task per hour, with connector-class overrides.

Storage and partition costs work from Console’s metadata indexer alone. Ingress and egress require Confluent Cloud or Gateway, which limits network-cost allocation without either integration.

Chargeback supports CSV and API export, and application groups can see only their own costs. It has been enabled by default since June 2026 and consolidated onto one page since Console 1.45.

I recommend Team for ownership, approvals, and cost allocation together. I reject its seat price for topic browsing alone.

Gateway: Encryption, Virtual Clusters and Failover

Clients change only bootstrap.servers; Gateway interceptors handle the data-path behavior. I favor that model for centralized controls, but Gateway adds infrastructure: at least 3 instances in production and a license key before it starts.

Interceptors and Encryption

Interceptors use declarative YAML with apiVersion gateway/v2 and kind Interceptor. Numeric priority runs lowest first, starting at 1, in the same order on produce and consume.

Scopes include:

• Service accounts
• GatewayGroups
• Virtual Clusters

The most specific scope wins. Cache processing runs last on requests, while integrity signing follows other interceptors.

Gateway generates one data key per record, wraps it with a single master key, and retains the encrypted data key in its store. Supported key managers include:

• HashiCorp Vault
• AWS KMS
• Azure Key Vault
• GCP KMS
• Fortanix

KEK rotation remains manual. Protect adds field-level and full-payload encryption alongside:

• Tokenization: Vault Transform produces deterministic values, preserving grouping and joins.
• Record integrity: Signing on produce, verification on consume, and rejection of failing records.
• Data controls: Crypto-shredding, configuration guardrails, traffic policies, and quality rules using CEL, JSON Schema, or schema ID.

Virtual Clusters, Partner Zones and Topic Views

Virtual Clusters divide a physical cluster into logical clusters. I favor Partner Zones for external sharing without replica clusters, using dedicated partner credentials and internal naming protection.

Gateway also provides:

• Topic concentration and aliases: Conduktor claims partition reductions above 90%.
• SQL Topics: An Enterprise feature.
• Preview topic views: Filter and reshape records during reads without creating a copied topic.
• Caching and large-message handling: Including payload offload to S3.

DR, Failover and Operations

DR & Failover redirects clients to a secondary cluster without changing bootstrap servers or credentials.

The add-on also supports zero-downtime migrations and chaos testing:

• Latency injection
• Broker failures
• Network partitions

Operational requirement	Gateway guidance
Production instances	At least 3
Minimum node	2 cores, 4 GB RAM; about 20 to 30 MB/s
Recommended starting node	4 cores, 8 GB RAM; about 40 to 50 MB/s
Heavy interceptors	About 4 GB RAM per CPU
Kafka connection	Admin user; Kafka 2.7.0+
Listener security	SASL, mTLS, or OAuth; TLS
Local credential protection	Random 256 bit GATEWAY_USER_POOL_SECRET_KEY
Management protection	Protected admin API and metrics
Request timing	Optional Prometheus histograms; disabled by default

No latency numbers are published, so I recommend benchmarking the extra hop with encryption enabled. Optional stage timings separate:

• Authorization
• Interceptor processing
• Upstream queuing
• Kafka processing

Gateway forwards KIP-714 client metrics from Kafka clients 3.7.0+ to an OpenTelemetry collector. I recommend enabling those metrics alongside stage timings when diagnosing client-to-broker delays.

Monitoring, Alerts, Activity Log and the MCP Server

Metrics and Alerts

I reject Community for overnight incident investigation: its monitoring exposes only the last hour. Historical metrics, alerting, and Prometheus integration require Team.

Alerts evaluate every minute using Prometheus queries over Console-collected data. Signals include:

• Topics: MessageCount, MessageIn, MessageOut, and MessageSize.
• Brokers: Offline, under-min-ISR, and under-replicated partitions.
• Consumer groups: OffsetLag and time lag.

Notification destinations are:

• Slack
• Microsoft Teams
• Email
• Webhooks with custom URLs and headers

Webhook secrets can come from environment variables. I prefer that option to embedding credentials in alert configuration.

Insights respects RBAC and separates:

• Overview
• Risk Analysis
• Cost Control
• VIP Topics

Data Quality Insights adds a composite health score, but I prioritize the underlying lag and partition signals for operational decisions.

Activity Log

Team’s activity log is searchable in Console and exportable to a Kafka topic in CloudEvents format. I value that export path for retaining operational events outside the management UI.

Recorded actions include:

• Topic creation, deletion, browsing, production, and SQL queries.
• Connector restarts and schema compatibility changes.
• Consumer-group duplication and alert triggers.

Credential redaction has applied since January 2026. I consider that essential when exporting activity beyond Console’s access controls.

The MCP Server

The MCP server is embedded in Console, with no separate service to deploy. Claude Desktop or another MCP client connects using a personal access token and inherits its RBAC.

Available reads cover:

• Topic records and schema compatibility.
• Consumer-group offsets and connector status.
• Access rules and Stream Lineage.
• Chargeback costs and the activity log.

Conduktor’s incident-triage example explains a group 180 records behind with no active members. I favor that use over unrestricted AI-driven cluster changes.

Read-only has one exception: set-topic-labels writes labels. I recommend keeping broader changes in the CLI, which also inherits user permissions.

Flink SQL from Console remains in preview.

How Does Conduktor Compare to Competitors?

Conduktor Team costs $1,200 per seat annually, while Kpow Enterprise starts at $4,500 per cluster with 100 users included.

• Kpow: Enterprise starts at $4,500 per cluster with 100 users included. Community supports 3 clusters and 10 users but excludes RBAC, masking, SSO, and an activity log. Against Conduktor’s annual per-seat bill, I recommend pricing Kpow first for large teams concentrated on few clusters.
• Lenses: Community is free for up to 5 users. Team starts at $4,000 annually for 15 users on one cluster, including SSO/SAML and RBAC; K2K replication starts at another $1,000 monthly. Multi-cluster deployments need Enterprise by quote. I favor this starting point for a team staying on one cluster.
• Kafbat UI and AKHQ: Both are Apache 2.0 open-source UIs without a vendor SLA, Chargeback, catalog, or proxy layer. I recommend them when a free Kafka interface matters more than Conduktor’s paid governance.
• Redpanda Console: Free to run, with an Enterprise license unlocking gated features. I recommend evaluating it before adding another management product when the brokers are already Redpanda.
• Confluent Control Center and Stream Governance: Both are tied to Confluent’s platform. Conduktor supports Confluent Cloud integration and Confluent role bindings. I favor Confluent’s direction when governance should remain platform-specific, and Conduktor when it needs to span providers.
• Kroxylicious: An Apache 2.0 Kafka proxy framework without a management UI. I recommend it for teams deliberately choosing a framework rather than Conduktor’s Console-and-Gateway combination.

I also keep Kong Event Gateway on the shortlist. For Conduktor, my deciding factors remain the per-seat Console bill, Gateway’s cluster minimum, and responsibility for self-hosting.

How I Reviewed Conduktor

I evaluated Console 1.48 and Gateway 3.22 around Community limits, Team seat costs, and Gateway’s production footprint. I ran the quick-start stack and worked through cluster connection, topic inspection, and consumer-group offset-reset controls.

I separated standard Console operations from paid Self-service, resource policies, Stream Lineage, and Chargeback. For Gateway, I assessed interceptor ordering, encryption responsibilities, and failover behavior.

My monitoring assessment distinguished last-hour visibility from historical metrics and alerts. I also checked the MCP server’s RBAC boundary and label-writing exception.

I compared pricing and feature gates with Kpow and Lenses, then considered Kafbat UI, AKHQ, Redpanda Console, and Kroxylicious as alternative deployment choices. I weighed Console’s external PostgreSQL requirement separately from Gateway’s minimum of 3 production instances.

I gave credit for the October CA-trust response: Gateway 3.22.3 and Schema Registry Proxy 1.0.1 shipped within 3 days of the October 20 disclosure.

Prices current as of October 2026.

Should You Manage Kafka With Conduktor?

I recommend Conduktor for a platform team governing Kafka across several product teams, not simply for anyone wanting a Kafka UI. Community covers 50 users and 3 clusters; Team’s $1,200 annual seat price buys ownership and governance, while Gateway Enterprise requires a separate quote.

For a single team within Community’s caps, I see little reason to pay before approval workflows or historical monitoring become necessary. For 50 engineers who only need topic browsing, I recommend skipping Team and comparing Kpow’s cluster pricing with Kafbat UI.

Gateway earns consideration when encryption, partner sharing, or failover without client reconfiguration is an actual requirement. I recommend budgeting for at least 3 production instances and the relevant Protect or DR & Failover add-on, rather than treating the proxy as a free Console extension.

Run the Conduktor quick-start Compose stack locally, then connect one real cluster in Community mode. Work through Console RBAC and the consumer-group reset workflow before committing to paid governance; choose Gateway only when its data-path controls justify operating the additional infrastructure.

FAQs

Is Conduktor free?

Conduktor Console Community is free with no time limit for up to 50 users and 3 clusters, without a license key. I recommend it for Kafka operations, SQL queries, live tail, and SSO. Gateway Community is also free, but requires a license key and covers cross-network access only.

How much does Conduktor Team Edition cost?

Conduktor Team Edition costs $125 per seat per month billed monthly, or $1,200 per seat per year billed annually. Purchase it online and receive the license by email. I budget $6,000 annually for 5 seats or $24,000 for 20 seats, before hosting costs.

Is Conduktor a SaaS or self-hosted?

Conduktor Console is self-hosted on every tier; there is no SaaS Console option. It requires external PostgreSQL 13+ and runs through Docker or Kubernetes. I include database backups and monitoring storage in the deployment budget rather than treating the license as the entire operating cost.

Does Conduktor work with AWS MSK and Confluent Cloud?

Conduktor supports AWS MSK and Confluent Cloud, alongside other Kafka providers running Kafka 2.7+. Console has dedicated Confluent Cloud and Aiven integrations. I recommend checking the service account’s Kafka ACLs separately from Console RBAC, because broker permissions and actions available through the UI are distinct controls.

Does Conduktor Gateway add latency?

Gateway adds a proxy hop, but Conduktor publishes no latency numbers to quantify its impact. I recommend benchmarking representative traffic with the intended interceptors enabled. Optional per-stage Prometheus timing metrics help isolate delays, and production sizing starts with at least 3 Gateway instances rather than a single proxy.