github.com/go-kratos/kratos

Kratos v1 provides a comprehensive microservices toolkit with built-in transport layers (gRPC, HTTP), middleware chains, and service discovery. The framework follows a convention-over-configuration approach that works well once you understand its patterns, but getting there requires significant effort. The code generation tooling helps scaffold services quickly, though the generated code can be opaque to newcomers.

The documentation is primarily in Chinese with English translations that are often incomplete or unclear. Error messages tend to be generic, making debugging challenging when things go wrong with the transport layer or middleware stack. IDE support is standard for Go projects, but without strong documentation, discoverability of framework features relies heavily on reading example code.

Note that v1.0.1 (2021) is the legacy version. The team has since moved to v2 with breaking changes and better ergonomics. If starting fresh, consider v2 instead. The v1 migration path is essentially a rewrite, as the architectural patterns changed significantly between versions.

Kratos presents a significant challenge for newcomers due to the confusing split between v1 and v2 versions. The package at github.com/go-kratos/kratos (v1.0.1) is essentially deprecated, while active development happens in v2 under a different import path. This creates serious onboarding friction as documentation often references v2 APIs that don't match v1, leading to hours of debugging import errors and incompatible code examples.

The v1 framework itself is quite opinionated, requiring you to structure projects in specific ways with heavy reliance on code generation. Error messages when you deviate from expected patterns are cryptic, often just generic reflection errors. While the framework handles gRPC and HTTP well once configured, getting there involves navigating scattered documentation and examples that assume familiarity with Bilibili's internal conventions.

Community support is challenging as most GitHub issues and Stack Overflow questions focus on v2, making it difficult to find relevant help for v1 problems. The Chinese-first documentation means English resources are often incomplete or machine-translated, adding another barrier for international developers.

Kratos v1 provides a well-structured microservices framework with good patterns for service discovery, tracing, and middleware composition. The framework encourages clean architecture and makes it straightforward to build gRPC and HTTP services side-by-side. However, from a security perspective, there are notable concerns that require careful attention.

The framework doesn't enforce TLS by default - you must explicitly configure it, and the documentation examples often show insecure configurations. Authentication and authorization are left entirely to the developer with minimal guidance or batteries-included solutions. Input validation isn't built into the framework layer, relying entirely on protobuf validation or custom middleware. Error handling can leak internal details if you're not careful with the default error interceptors.

The dependency chain is manageable but this v1 release is essentially legacy - the project moved to v2 with breaking changes. Supply chain risk is moderate given the Bilibili backing, but CVE response isn't clearly documented. For production use, expect to invest significant effort hardening the defaults.