Modern protocols
HTTP/1.1, HTTP/2 and HTTP/3 (QUIC); TLS offload, re-encrypt and passthrough with SNI.
Kardo by Axiv Networks
The next generation Application Delivery Controller
An L4-L7 load balancer with a learning WAF (self-building policies and incidents), GeoLB/GSLB and clustering. Distributed as a VM, a bare-metal installer and a hardware appliance.
- HTTP/3 & QUIC
- OWASP CRS
- Raft + VRRPv3
- Offline licensing
Load balancing
L4 to L7, without compromise
HAProxy for HTTP and TCP, IPVS for UDP and DSR, nftables at the edge. Kardo renders, validates and hot-reloads the data plane for you.
Content switching
ACL-based routing, rewrites and redirects, traffic rules with condition trees, Lua scripts and a simulator.
Zero-downtime changes
Hot reloads in master-worker mode; weights, state and drain go through the Runtime API without a reload.
Health & persistence
Active and passive health checks (including ICMP), cookie, source, header and stick-table persistence, slow start.
Backend protocols
HTTP/1.1, h2 and h2c (gRPC), FastCGI for PHP-FPM and AJP13 for Tomcat through the kardo-ajp gateway.
HTTP caching
Choose per virtual service: native HAProxy cache, Varnish, nginx or Kardo Cache, an RFC 9111 cache distributable in the cluster.
Learning WAF
The WAF is what makes Kardo different
A positive security policy that builds itself, suggestions and incidents, with the ease of use you expect from a modern product.
A positive model, learned from your traffic
Kardo samples real requests and proposes URLs, parameters, file types, headers and cookies with their types and limits. Suggestions get a learning score; entities move from staging to enforced automatically or after your review.
- Automatic, manual or disabled learning per policy
- Safety rails: loosening needs traffic from many networks
- Policy templates and versioned policies
Incidents, not alert fatigue
Violations are correlated asynchronously into incidents, so you look at attacks and campaigns instead of thousands of single events. False positives have their own workflow that feeds the policy.
- Support ID on every block page
- Structured JSON event log, exportable via syslog, CEF and LEEF
- OWASP Top 10, API Top 10, CWE and PCI DSS mapping
Patch the vulnerability before the code
Import reports from OWASP ZAP, Burp Suite, Qualys WAS, Tenable, Acunetix/Invicti and SARIF. Findings become virtual patches you can test and accept, with a full open → patched → verified → remediated lifecycle.
- Signed CVE rule packs, separate from system updates
- Daily signature channel with staging and rollback
- Offline upload for air-gapped networks
GeoLB / GSLB
Send every user to the right site
kardo-gslb is an authoritative DNS server for the zones you delegate to Kardo. It checks the health of every site, reads the state of other Kardo nodes and answers with the best destination.
- Round robin, weighted, failover, geo, proximity, least connections/load, all-available
- EDNS Client Subnet for accurate geolocation behind public resolvers
- Shared GeoIP database with the WAF and traffic rules
Clustering & HA
Built to never go down
Configuration is replicated with Raft over mTLS between nodes. VIPs move with VRRPv3, implemented in Go inside kardod. Choose an HA pair with an optional witness against split brain, or an N-node active/active cluster.
- Every change is a versioned transaction with diff and rollback
- Stick tables synchronized across peers
- A node holds VIPs only when it sees the Raft quorum
Access & identity
Secure access, at the edge
Access gateway
Pre-authentication with OIDC, SAML, LDAP, RADIUS with OTP, JWT and client certificates; Kerberos constrained delegation to backends.
Remote access
A user portal with RDP, SSH, VNC and web bookmarks, a native RD Gateway, clientless sessions and WireGuard network tunnels.
HSM & KMS keys
Private keys on PKCS#11 tokens: Luna, nShield, CloudHSM, cloud KMS, Vault, YubiHSM. Universal certificate import and ACME.
Admin MFA
LDAP/AD, RADIUS, TACACS+, OIDC and SAML for administrators, with native TOTP, passkeys, email and Duo.
Kubernetes
Kardo in front of your clusters
The kardo-k8s connector runs on the cluster leader and watches Ingress, Gateway API, LoadBalancer Services, EndpointSlices, nodes and TLS Secrets. It publishes them as managed virtual services, pools, traffic rules and certificates, and writes status and Events back into Kubernetes.
- Pod or NodePort members, VIPs from address pools
kardo.io/annotations for fine tuning- Applied as automatic commits by
kubernetes:<cluster>
Observability
See every millisecond
Response-time percentiles, Apdex, error rate, top URLs and clients per virtual service, pool and server. W3C distributed tracing makes your application spans children of Kardo’s span.
- Prometheus metrics for every component
- OpenTelemetry, Splunk HEC, Elastic, Loki, Kafka and Datadog exporters
- Alerting to email, webhooks, Slack/Teams, syslog and SNMP traps
Editions
Pick the edition, add what you need
Licenses are signed and verified offline, replicated across the cluster and never stop traffic: an expired license only blocks changes to licensed features.
Community
Free, with a registered license
Up to 20 Mbit/s
- L4/L7 load balancing, TLS, certificates and ACME
- Traffic rules, access control, IP lists, error pages
- Statistics, alerting, logging, NetFlow/IPFIX
- Kardo Cache and Kubernetes integration
Standard
Production load balancing
Up to 100 Mbit/s
- Everything in Community
- Higher throughput per appliance
- Add-ons available, such as GSLB or WAF
Advanced
Multi-node and multi-site
Up to 1 Gbit/s
- Everything in Standard
- Clustering and HA (VRRP, Raft), unlimited data nodes
- GeoLB / GSLB
- All cache engines: HAProxy, Varnish, nginx
Enterprise
The complete platform
Up to 10 Gbit/s
- Everything in Advanced
- Learning WAF with incidents and compliance reports
- Advanced analytics, Lua scripts
- Access gateway and HSM/KMS keys
- Add-ons: virtual patching, remote access
Throughput caps are per appliance and per direction. Every new installation starts with a 30-day trial; contact us for pricing and add-ons.
Roadmap
Shipped, and what's next
-
M1 · M2 Shipped
L4-L7 load balancing and WAF core
Data plane rendering and hot reload, TLS, HTTP/2, L4 UDP/DSR, ACME; SPOA agent with Coraza and OWASP CRS.
-
M3 · M5 Shipped
Learning WAF, Web UI and clustering
Suggestions, learning score, incidents; React UI with RBAC; HA pair and N-node Raft cluster.
-
M6 · M8 Shipped
GeoLB and enterprise features
Authoritative DNS with GeoIP, candidate configuration and commit, analytics, alerting, Kubernetes, access gateway, API keys, HSM.
-
M10 · M11 In progress
WAF add-ons and remote access
Virtual patching and the remote access portal with WireGuard tunnels are in; API security, bot defense and behavioral DDoS are being evaluated.
-
Next Planned
Kardo Central and the AI assistant
Fleet management for many appliances, and an assistant that writes only to the candidate configuration.
FAQ
Questions, answered
What is Kardo built on?
A Go control plane (kardod) with a REST API, a React UI and Raft-replicated configuration, driving HAProxy, IPVS and nftables on a minimal Debian base with a read-only, verified /usr and A/B updates.
Does a license problem ever stop my traffic?
No. Licenses are verified offline and an expired or invalid license only blocks changes to licensed features. Traffic keeps flowing.
Can I run Kardo in an air-gapped network?
Yes. Licensing is offline, and both system updates and WAF signature bundles can be uploaded manually.
How do I automate Kardo?
Use the REST API v1 with API keys, the kardoctl CLI, the Terraform provider kardo/kardo or the Ansible collection kardo.adc.
Put Kardo in front of your apps
Talk to our engineers about your architecture, or start a 30-day trial today.