Introducing Kardo by Axiv Networks
Kardo is the next generation Application Delivery Controller: an L4-L7 load balancer with a learning WAF, GeoLB/GSLB and clustering, in a single platform you can run as a VM, on bare metal or as a hardware appliance.
One platform, every layer
Kardo replaces the patchwork of load balancers, WAFs, DNS balancers and VPN gateways with one control plane, one API and one UI.
HAProxy and IPVS data planes driven by Kardo: HTTP/1.1, HTTP/2, HTTP/3, TLS offload, content switching, persistence, active and passive health checks, slow start and connection draining. Configuration changes are hot reloads: no connection is lost.
Positive security policies that build themselves from real traffic, OWASP CRS signatures, incidents instead of noise.
Authoritative DNS with geo, proximity and load-aware methods across all your sites.
Raft-replicated config, VRRPv3 VIPs, HA pairs with witness or N-node active/active.
Pre-authentication with OIDC, SAML, LDAP and RADIUS/OTP, plus a remote access portal and WireGuard tunnels.
The kardo-k8s connector watches Ingress, Gateway API and LoadBalancer Services and publishes them as managed virtual services, pools and certificates.
How it works
Traffic hits a Kardo VIP, crosses the WAF and reaches the healthiest server. All in a single hop.
Traffic rules and access policies decide what goes through, before the request reaches the WAF.
kardo-waf checks the request against your learned policy and the OWASP CRS signatures.
Content switching, persistence and health-aware balancing send it to the right server, L4 or L7.
Latency percentiles, Apdex, W3C tracing and exports to your SIEM, OpenTelemetry, Splunk or Elastic.
Learning WAF
Kardo watches your real traffic and proposes the positive model of your application: URLs, parameters, types, lengths, file types, headers and cookies. You review the suggestions, move entities from staging to enforced and let the policy tighten over time.
Infrastructure as code
A stable REST API v1 with OpenAPI, scoped API keys, an official Terraform provider and an Ansible Galaxy collection. Every change lands in a shared candidate configuration and goes live with a validated commit, with automatic rollback.
kardo/kardokardo.adckardoctl CLI and API keys with scopes, networks and expiryresource "kardo_pool" "web" {
id = "web"
algorithm = "leastconn"
health_check = { type = "http", path = "/health" }
servers = [
{ id = "web1", address = "10.0.1.11", port = 8080 },
{ id = "web2", address = "10.0.1.12", port = 8080 },
]
}
resource "kardo_virtual_service" "shop" {
id = "shop"
address = "203.0.113.10"
port = 443
protocol = "https"
default_pool_id = kardo_pool.web.id
waf = { policy_id = "shop", fail_mode = "close" }
}
- hosts: localhost
tasks:
- name: Pool for the shop
kardo.adc.kardo_pool:
id: web
servers:
- { address: 10.0.1.11, port: 8080 }
- { address: 10.0.1.12, port: 8080 }
- name: Publish the shop over HTTPS
kardo.adc.kardo_virtual_service:
id: shop
address: 203.0.113.10
port: 443
protocol: https
$ export KARDO_SERVER=https://kardo.example.net
$ export KARDO_API_KEY="$KARDO_CI_TOKEN"
$ kardoctl pool apply -f pools/web.json
# the change lands in the shared candidate configuration
$ kardoctl commit -m "deploy $CI_COMMIT_SHA"
# validated, committed and live on every cluster node
Deploy anywhere
OVA for VMware, qcow2 for KVM and Proxmox, VHD(X) for Hyper-V and images for AWS, Azure and GCP.
An ISO installer for your own servers, with NIC driver verification and no shell exposed.
Certified hardware with NIC and IRQ tuning, running the very same hardened image.
Latest news
Book a live demo with our engineers, or start a 30-day trial on your own infrastructure.
