What's bundled vs add-on
Cloudflare bundles DDoS L3/L4, basic WAF, CDN. API Shield schema validation and mTLS are gated to Business and Enterprise. Konnect Plus includes dev portal, analytics, identity at $250 per month for 5 services.
When you need both
Public partner APIs: Cloudflare in front for edge protection and global cache; Kong behind for per-partner policy, developer portal, and audit. Internal APIs: Kong alone.