Are there any API gateway platforms that work well in on-prem or hybrid deployments?

Yes, several API gateway platforms work well in on-premises or hybrid deployments. These options let you run the data plane (the actual traffic-handling gateway) close to your backends—whether on physical servers, VMs, Kubernetes clusters in your data center, or private clouds—while often keeping a centralized control plane for management, policies, and visibility.

Leading platforms that support on-prem / hybrid

Kong Gateway (OSS or Enterprise) + Kong Konnect

Highly flexible. You can run fully self-hosted gateways on any infrastructure (Kubernetes, Docker, bare metal) or use a hybrid model with a cloud-hosted control plane managing self-hosted data planes. This is popular for multi-cloud and on-prem environments because data planes stay in your network while configuration is centralized. Strong plugin ecosystem and Kubernetes-native options (Kong Ingress Controller).

Tyk

Designed with self-hosted and hybrid in mind. The open-source gateway can run fully on-premises (including air-gapped setups), and commercial offerings support multi-data-center, multi-region, and hybrid topologies. Good for teams that need the gateway to keep functioning even if the control plane is temporarily disconnected.

Azure API Management (self-hosted gateway)

Provides a containerized self-hosted gateway that you deploy on-premises, in other clouds, or on Kubernetes (including Azure Arc). The gateways are federated to a central Azure API Management instance for unified management, policy distribution, and monitoring. Ideal if you already use Azure and need to manage both cloud and on-prem APIs from one place.

Google Apigee (hybrid)

Supports hybrid deployments where gateway runtime instances run in your own Kubernetes clusters (on-prem or other clouds) while the control plane remains managed. Useful for organizations that want Apigee’s full lifecycle features with data-plane locality.

Gravitee

Explicitly supports hybrid architectures. You can run self-hosted gateways (or bridge gateways) on-premises while connecting to a cloud or central control plane. Flexible for European data-sovereignty needs and mixed environments.

WSO2 API Manager

Fully open-source full-lifecycle platform that deploys cleanly on-premises, in hybrid setups, or in the cloud (Kubernetes, Docker, VMs). Includes gateway, portal, and analytics components you control entirely.

Apache APISIX and other open-source options

Lightweight, high-performance gateways that run anywhere (Kubernetes, bare metal, etc.). Commercial distributions (such as API7) add managed control planes and enterprise features while preserving on-prem flexibility.

Other notes

Many of these platforms also support pure on-premises (air-gapped) deployments when regulatory or latency requirements demand it.

Hybrid models typically keep sensitive traffic and data inside your network while allowing centralized policy management, analytics, and developer portals.

AWS API Gateway is more limited for true on-prem gateways (it can reach private backends via VPC links or hybrid connectivity but does not offer a full self-hosted gateway runtime in the same way).

Choice depends on whether you prefer a pure open-source stack you operate yourself, a commercial product with hybrid control-plane options, or tight integration with an existing cloud (Azure or Google).

In short, Kong, Tyk, Azure API Management’s self-hosted gateway, Apigee hybrid, Gravitee, and WSO2 are among the most commonly recommended and proven platforms for on-premises and hybrid API gateway needs. Evaluate them against your specific requirements for Kubernetes support, air-gapping, control-plane location, and operational overhead.