Overview

KrakenD is an open source API gateway written in Go that sits in front of your services and turns them into a single, consistent API. It takes a different route from most gateways: instead of a database, an admin API or a runtime state to manage, everything KrakenD does is described in one declarative krakend.json file. Start the binary with that file and it proxies, aggregates, transforms and protects your endpoints.

That stateless design is the point. Every node is identical and independent, so you scale out by starting more instances rather than by coordinating a cluster, and the configuration travels with your code through GitOps like any other artefact. The project reports more than 70,000 requests per second on a single modest instance, with memory use typically under 50 MB even at over a thousand concurrent connections.

How it works

Declarative routing

Each endpoint in the configuration declares its method, its public URL pattern, and the backends that serve it. There is no runtime API to script and no state to drift: the file you commit is the behaviour you get.

Response aggregation

An endpoint can fan out to several backends and merge the answers into one payload, which makes it practical to expose a mobile-friendly BFF without writing a service for it. Companion directives let you filter, group, rename, wrap or flatten fields, and convert transparently between XML and JSON.

Concurrent backends

Backend calls for a single endpoint are issued in parallel, so the gateway’s latency tracks the slowest dependency rather than the sum of all of them.

Security and traffic control

• Zero-trust defaults, JWT validation, OAuth, API keys and CORS handling at the edge.
• HSTS, clickjacking protection, HPKP, MIME-sniffing prevention and XSS protection headers.
• Rate limiting at the router and proxy layers, with bursting, load balancing between backend instances, and circuit breakers.
• TLS and HTTP/2 out of the box.

Observability

KrakenD emits metrics and traces that plug into the tools teams already run: Prometheus and Grafana for metrics, Jaeger and Zipkin for distributed tracing, Datadog for a managed pipeline. Because logging and telemetry stay outside the gateway’s core path, an observability outage does not take the API down with it.

Extending it

Custom logic can be added without forking the project by using Lua scripts, Martian modifiers or Google CEL expressions. The Community Edition dropped Go plugin support in the 3.x line; if a plugin is unavoidable, the recommended routes are compiling your extension into your own binary, expressing the logic in Lua, or moving to the commercial Enterprise edition, which keeps plugin support with vendor toolchain assistance.

Running it

KrakenD ships as static binaries for Linux, macOS and Windows, as packages, and as an official container image. A first run is a single command with the stock configuration, after which you replace the config file with your own. Because there is no interface to click through, configuration is usually drafted in the project’s KrakenD Designer, a small open source static web application that writes krakend.json entirely in the browser and never uploads what you load into it.

Licence

KrakenD Community Edition is released under the Apache License 2.0, so it can be used, modified and redistributed commercially. The separate Enterprise edition is a paid commercial product; features such as plugin support, advanced rate limiting and vendor support live there rather than in the open source edition.

Alternatives

• Traefik — open source reverse proxy and gateway with automatic service discovery and a different, more dynamic configuration model.
• Caddy — open source web server and reverse proxy with automatic HTTPS, a good fit for simpler proxying needs.
• nginx — the long-standing open source web server and reverse proxy many teams already run.

If your priority is an API gateway that is defined entirely in one reviewable file and scales by adding identical nodes, KrakenD is worth a look in the directory.