Kong Alternatives and Competitors Compared

The question behind many "Kong alternatives" searches is whether Kong Gateway is still free to run. We looked for a Kong announcement that says its open-source edition has ended and did not find one, so this page does not say that. It quotes what Kong has published, and the dates matter.

• Kong's breaking-changes page for Gateway 3.10.0.0 says: "Free mode is deprecated and will be removed in a future 3.x version of Kong Gateway Enterprise." and "At that point, running Kong Gateway without a license will behave the same as running it with an expired license."
• On the Kong community forum, a reply dated 12 March 2026 says: "For Gateway 3.10 and above, you will need to make sure you have a license installed if you do not already." (forum thread)
• Kong's version support policy lists Gateway Enterprise releases up to 3.16, first released on 15 September 2026, with an LTS supported for three years and a minor version for one.
• The public Kong/kong releases page shows 3.9.4 as the latest release at our check on 4 November 2026.

Those four facts are consistent with a split between a 3.9 community line and a licensed 3.10-and-later line, but Kong has not said so in anything we read, and we draw no conclusion. The practical advice is narrower: check which Kong Gateway version each environment runs, and ask Kong in writing what the licence terms are for that version. Kong Gateway Enterprise 3.9 also entered its end-of-life phase in January 2026, with a 12-month sunset period that ends in January 2027, per Kong's notice.

Moving a gateway is a migration of every consumer-facing behaviour, so the bar for leaving should be higher than "the licence question exists". Staying is right when the plugins you use (key authentication, OAuth or OpenID Connect, rate limiting, request transformation) have no cheap equivalent in the alternative, when your teams already know Kong's declarative config and decK workflow, or when you rely on Konnect for a control plane across data centres.

On price, Kong's pricing page (checked 4 November 2026) lists Konnect Plus from $25 per month plus usage, billed monthly, for API Management and AI Management, and says fully self-hosted gateways, where both control plane and data plane run in your estate, are part of its separate Gateway Enterprise offering with custom pricing. Those are list lines, not what a given contract costs.

If you stay and the real problem is who answers at 3 a.m., an independent contract is cheaper than a migration. AceMQ's Kong support covers both Gateway Enterprise and the open-source build on any version, and which companies offer Kong support compares Kong Inc., the community and independent providers.

The Gateway API is the Kubernetes project's successor to Ingress, with Gateway, HTTPRoute and related resources that several data planes implement. The project's implementations page (checked 4 November 2026) lists Envoy Gateway, kgateway, Traefik Proxy, NGINX Gateway Fabric, Istio and Kong Operator as conformant, with kgateway described as generally available with its 2.0 release. Apache APISIX and Tyk were not on that page's list at our check, which does not mean they lack Gateway API support, only that the project's page does not show it.

What this means for a Kong estate: routes and services map to HTTPRoute and backend references reasonably directly. Plugins do not. Authentication, rate limiting and transformation sit outside the core Gateway API in each project's own policy resources, so every Kong plugin you use becomes a decision: find the equivalent policy, move it to another layer (an identity-aware proxy, a service mesh, the application), or drop it. That mapping, not the proxy, is the cost of the move.

Apache APISIX is an Apache Software Foundation top-level project under Apache 2.0. Its deployment modes are traditional (control and data plane in one instance, config in etcd), decoupled (separate instances, both using etcd) and standalone (no etcd; rules come from a local YAML or JSON file, or live in memory behind an API). That standalone file mode is the closest equivalent to Kong's DB-less mode. Its plugin model is the nearest in shape to Kong's, which makes it the usual shortlist entry for teams that want a similar gateway under a different licence.

Tyk's open-source Gateway and Pump are under MPL 2.0, and its Dashboard, Developer Portal, Operator and Multi Data Center Bridge need a licence key, per Tyk's documentation. It requires Redis in production, which is one more stateful service to run highly available. Do not call Tyk fully open source: the open core and the licensed components are different products.

Traefik is MIT-licensed per its repository and strongest as an ingress that grew gateway features. It fits a team that already routes with Traefik and needs fewer API-management features than Kong's plugin catalogue provides.

Envoy Gateway (Apache 2.0) and kgateway (Apache 2.0, formerly Gloo, a CNCF sandbox project) put Envoy behind the Gateway API. They suit platform teams that want Kubernetes-native config in Git and are comfortable replacing plugin-by-plugin behaviour with policy resources. NGINX is BSD-2-Clause, and NGINX Gateway Fabric is its Gateway API implementation; it fits estates that already operate NGINX widely and need routing, TLS and simple policies rather than a plugin ecosystem. AceMQ supports NGINX and plans moves off the retired Ingress NGINX controller; see NGINX services and Ingress NGINX migration.

Apigee is a different shape of answer: managed API management from Google Cloud, with proxies, policies, a developer portal and analytics, instead of a gateway you operate. It trades control and portability for not running the platform. AceMQ supports Apigee estates; see Apigee consulting and support.

Every option above needs the same inventory first. If you run Kong with a database, export it; if you run DB-less, the declarative file already is the inventory, and Kong's DB-less documentation notes that each load replaces the whole configuration. List:

1. Services and routes: hosts, paths, methods, header matches, strip-path and regex routes. Regex routes are where Gateway API HTTPRoute matching differs most.
2. Plugins, global and scoped, with the order they run in. Mark each as authentication, traffic control, transformation, observability or custom Lua. Custom Lua plugins are rewrites in every alternative.
3. Consumers and credentials: key-auth keys, JWT secrets, OAuth clients. These are secrets, so the move needs a rotation plan, not a copy.
4. Upstreams and health checks: active and passive checks, retries and timeouts, which differ in default behaviour between proxies.
5. Certificates, SNI and mTLS settings.
6. Where state lives: Postgres, DB-less file, Konnect. This decides whether the target needs etcd, Redis or nothing.

Run the new gateway beside Kong on mirrored or shadowed traffic, compare response codes and latency per route, and move consumers route by route. AceMQ's gateway work is this assessment and plan; see Kong consulting.

Stay if your estate is a handful of services behind Kong with standard plugins and the only driver is a headline. Stay if your team has no Kubernetes platform capacity: Gateway API implementations assume you run controllers and custom resources well. Stay if you hold a Kong Enterprise or Konnect agreement you use fully. Move, or at least price a move, if you have standardised on Gateway API across clusters, if licence terms for the Kong version you need do not fit your policy, or if one alternative already runs in your cluster and doing the work twice is the real cost.

We compared options on licence, Gateway API conformance, state, plugin model and support route, using the vendors' and projects' own pages. Prices are list lines with a date; none are quotes. All checked 4 November 2026: Kong breaking changes, Kong version support policy, Kong pricing, Kong DB-less mode, Gateway API implementations, APISIX deployment modes, Tyk open-source Gateway, and the licence files of Envoy Gateway, kgateway and Tyk. AceMQ is not a Kong, Tyk, Traefik, F5, Google or Apache partner or reseller. Vendor pages change; re-check anything you plan to rely on.