Skip to content
SPECIFICTION
Get listed

BFE Ingress Controller

bfe-networks.net

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit bfe-networks.net
Spec score 9.0 #2 of 28 in Kubernetes Ingress Controllers

What it is

BFE Ingress Controller is an open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End. It is self-hosted and supports Linux, macOS, Windows, and API use. BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI traffic; HTTP/3 is planned. Operators define content-based routing rules with a domain-specific language. Traffic features include global and distributed load balancing, zone-aware balancing, resilience to zone-level failures, and overload protection. Each tenant has an isolated configuration that is not visible to other tenants. A built-in plugin framework supports extensions for traffic management, security, and observability. For operations, BFE provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. The project lists integrations with mainstream Layer 4 load balancers and ecosystem projects such as Kubernetes, Prometheus, Jaeger, and Fluentd. It is licensed under Apache 2.0 and is a CNCF sandbox project. Documentation covers installation from source and through binary, Go, Snap, and Docker paths. The open-source plan is free.

Spec sheet

What it does
BFE Ingress Controller implements Kubernetes Ingress on top of the BFE layer-7 load balancer.Read 15 Oct 2026 · github.com
Product
BFE is an open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End.Read 7 Oct 2026 · bfe-networks.net
Platforms
The vendor says BFE runs on Linux, Windows, Mac OS, and almost any platform to which Go compiles; its download page lists Darwin, Linux, and Windows binaries.Read 7 Oct 2026 · bfe-networks.net
Integrations
Official documentation names Kubernetes, Prometheus, Jaeger, Fluentd and mainstream layer-4 load balancers as integrations.Read 15 Oct 2026 · bfe-networks.net
Security
The vendor says BFE is written in Go, a memory-safe language, and describes it as immune to buffer overflow vulnerabilities.Read 7 Oct 2026 · bfe-networks.net
Support
The project directs questions and issues to GitHub and lists CNCF Slack and WeChat community channels.Read 15 Oct 2026 · bfe-networks.net
License
BFE and the ingress controller are released under the Apache 2.0 license.Read 15 Oct 2026 · github.com
API security warning
Documentation says the management API should be reachable only from an internal network.Read 15 Oct 2026 · bfe-networks.net
CNCF status
BFE is a CNCF Sandbox project, a category CNCF describes as experimental and not yet widely tested in production.Read 15 Oct 2026 · cncf.io
Company founded
LinkedIn lists Baidu as founded in 2000 and having more than 10,001 employees.Read 15 Oct 2026 · linkedin.com
Company ownership
Baidu, Inc. is the company behind BFE; LinkedIn lists it as a public software company headquartered in Beijing.Read 15 Oct 2026 · linkedin.com
Control plane
The broader BFE system separates BFE Server from API Server, Conf Agent and Dashboard control-plane components.Read 15 Oct 2026 · bfe-networks.net
Cookie routing
Ingress traffic can be routed using cookie conditions.Read 15 Oct 2026 · github.com
Documentation scope
Ingress documentation includes deployment, RBAC, configuration, status, route priority, TLS, load balancing, redirects, rewrites, FAQ and annotations.Read 15 Oct 2026 · github.com
Extensibility
BFE offers Go plugin modules and a WebAssembly plugin path through a proxy-Wasm host.Read 15 Oct 2026 · hysenlabs.com
Header routing
Ingress traffic can be routed using HTTP header conditions.Read 15 Oct 2026 · github.com
Host routing
Ingress traffic can be routed using Host rules.Read 15 Oct 2026 · github.com
Hot reload
Configuration reloads are designed to avoid interrupting existing long-lived connections.Read 15 Oct 2026 · github.com
Independent listing
Kubernetes documentation lists BFE Ingress Controller as a third-party BFE-based controller and says Kubernetes does not maintain third-party controllers.Read 15 Oct 2026 · kubernetes.io
Installation
The documentation describes installing from source and provides binary, Go, Snap, and Docker installation paths.Read 7 Oct 2026 · bfe-networks.net
Installation methods
The project documents source, binary, Go, Snap and Docker installation paths.Read 15 Oct 2026 · bfe-networks.net
Kubernetes API limit
Kubernetes says the Ingress API is frozen and recommends Gateway API for new development.Read 15 Oct 2026 · kubernetes.io
Kubernetes deployment
The ingress controller can be installed with kubectl manifests or a Helm 3 chart.Read 15 Oct 2026 · github.com
Limit: documentation gap
Independent analysis notes that English control-plane documentation was listed as coming soon and operational guidance was thinner than the codebase.Read 15 Oct 2026 · hysenlabs.com
Limit: Kubernetes packaging
Independent analysis characterizes the Kubernetes setup as a kustomize example rather than a managed operator and notes possible cleanup or finalizer troubleshooting.Read 15 Oct 2026 · hysenlabs.com
Limit: operational complexity
Independent analysis says a fleet with API, UI and configuration management requires four separate deployments because the data plane and control-plane components are split.Read 15 Oct 2026 · hysenlabs.com
Limit: plugin maintenance
Independent analysis says compiled Go plugins require rebuilds and redeployments, while WebAssembly plugins add a runtime compatibility layer.Read 15 Oct 2026 · hysenlabs.com
Load balancing
The platform provides global and distributed balancing with zone awareness, zone-failure resilience and overload protection.Read 15 Oct 2026 · bfe-networks.net
Multi-tenancy
Tenant configurations are isolated so one tenant cannot see another tenant's configuration.Read 15 Oct 2026 · bfe-networks.net
Notable news
Baidu's developer publication says the BFE engine was open-sourced in July 2019 and accepted into CNCF Sandbox in June 2020.Read 15 Oct 2026 · developer.baidu.com
Notable release
Baidu announced in October 2021 that API-Server, Conf-Agent and Dashboard were released under Apache 2.0 alongside the ingress controller.Read 15 Oct 2026 · developer.baidu.com
Observability
Built-in metrics, logs and distributed tracing are provided for operations and troubleshooting.Read 15 Oct 2026 · bfe-networks.net
Path routing
Ingress traffic can be routed using URL path rules.Read 15 Oct 2026 · github.com
Plugin framework
A plugin framework lets developers add controller behavior.Read 15 Oct 2026 · github.com
Plugins
Its built-in plugin framework supports adding features, including traffic management, security, and observability plugins.Read 7 Oct 2026 · bfe-networks.net
Praise: CMB deployment
A CNCF case study reports China Merchants Bank running more than 100 BFE instances for over 100,000 applications.Read 15 Oct 2026 · cncf.io
Praise: recovery time
The same case study reports zone-failure recovery under 20 seconds compared with roughly 8–10 minutes using DNS.Read 15 Oct 2026 · cncf.io
Protocols
BFE supports HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC and FastCGI, while HTTP/3 is planned.Read 15 Oct 2026 · bfe-networks.net
Public API
The management API exposes monitoring, reload and profiling endpoints on port 8421 by default.Read 15 Oct 2026 · bfe-networks.net
Routing
BFE uses a domain-specific language to define content-based routing rules.Read 7 Oct 2026 · bfe-networks.net
Routing language
Routing uses a domain-specific language for content-based rules.Read 15 Oct 2026 · bfe-networks.net
Security reporting
Security vulnerabilities should be reported privately to [email protected].Read 15 Oct 2026 · bfe-networks.net
Service balancing
The controller balances traffic across multiple Kubernetes Services belonging to one application.Read 15 Oct 2026 · github.com
Source requirements
Source installation requires Go 1.17 or newer, Git 2.0 or newer and glibc-static 2.17 or newer.Read 15 Oct 2026 · bfe-networks.net

Plans and prices

Open source Free Apache 2.0 license · no paid tiers stated Read 15 Oct 2026 · bfe-networks.net

Every BFE Ingress Controller plan and price →

Strong points and limits

Strong points

  • Supports HTTP/2, WebSocket, gRPC, and FastCGI.
  • Offers global and distributed load balancing.
  • Tenant configurations are isolated.
  • Includes metrics, logs, and distributed tracing.
  • Available under the Apache 2.0 License.

Limits

  • HTTP/3 is only planned.
  • The project is self-hosted.
  • Support answers GitHub issues on working days.

Who it suits

BFE suits teams operating self-hosted Layer 7 load balancing and routing. Its listed multi-tenancy, observability, and deployment options are relevant to operators managing traffic across isolated tenant configurations.

Verdict

BFE provides a broad set of routing, balancing, and observability functions for self-hosted deployments. Teams should note that HTTP/3 is planned rather than listed as supported.

Where Specifiction places it

Alternatives to BFE Ingress ControllerAll alternatives →