Skip to content
SPECIFICTION
Get listed

Emissary-ingress

emissary-ingress.dev

Free plan LinuxSelf-hosted
Visit emissary-ingress.dev
Spec score 7.7 #17 of 29 in API Gateway Software

What it is

Emissary-ingress is a free, open-source Kubernetes API gateway, Layer 7 load balancer, and Ingress built on Envoy Proxy. It handles HTTP, HTTPS, HTTP proxy, HTTPS proxy, TCP, TLS, gRPC, and HTTP/3 traffic. Developers can add, remove, merge, or separate services through Kubernetes resources or annotations, and use annotations to control traffic shares for canary deployments. Emissary stores state in Kubernetes rather than requiring a separate database, with Envoy handling routing and proxying. It can check requests through an external authentication service and a third-party rate limit service, and supports request transformation and client certificate validation, including mutual TLS. A diagnostics service helps investigate configuration issues. Emissary can act as an Istio edge proxy and supports Consul service discovery. It is self-hosted on Linux; Helm is the recommended installation method, with Kubernetes YAML also documented. The project is intended for cloud-native organizations where developers operate their services, as well as developers and operators.

Spec sheet

What it does
Emissary-ingress is an open-source Kubernetes-native API gateway, Layer 7 load balancer, and Kubernetes Ingress built on Envoy Proxy.Read 3 Oct 2026 · emissary-ingress.dev
Architecture
Emissary persists state in Kubernetes instead of requiring a separate database, and uses Envoy for traffic routing and proxying.Read 3 Oct 2026 · emissary-ingress.dev
Authentication and rate limiting
Emissary can check incoming requests with an external authentication service and a third-party rate limit service before routing them.Read 3 Oct 2026 · emissary-ingress.dev
Canary deployments
Developers can control how much production traffic is routed to a service through annotations.Read 3 Oct 2026 · emissary-ingress.dev
Client certificate security
Emissary can validate client certificates using a provided CA certificate, enabling client-side mutual TLS.Read 3 Oct 2026 · emissary-ingress.dev
Community support
The project directs users to its CNCF Slack channel for community questions and to GitHub issues for bugs.Read 3 Oct 2026 · emissary-ingress.dev
Consul integration
Emissary supports Consul service discovery and can use the Ambassador Consul Connector for mTLS authentication and encryption with Consul Connect services.Read 3 Oct 2026 · emissary-ingress.dev
Diagnostics
Emissary includes a diagnostics service for debugging configuration issues.Read 3 Oct 2026 · emissary-ingress.dev
For
Emissary was designed for cloud-native organizations where developers have operational responsibility for their services, and for use by developers and operators.Read 3 Oct 2026 · emissary-ingress.dev
Installation
The recommended installation method is Helm; Kubernetes YAML is another documented option.Read 3 Oct 2026 · emissary-ingress.dev
Istio integration
Emissary can act as the edge proxy for Istio, routing external traffic to the internal service mesh.Read 3 Oct 2026 · emissary-ingress.dev
Protocol support
Emissary supports gRPC and HTTP/2 routing.Read 3 Oct 2026 · emissary-ingress.dev
Self-service
Developers can add, remove, merge, or separate services through Kubernetes resources or annotations.Read 3 Oct 2026 · emissary-ingress.dev

Plans and prices

Emissary-ingress Free Open-source Kubernetes API gateway Read 3 Oct 2026 · emissary-ingress.dev

Every Emissary-ingress plan and price →

Strong points and limits

Strong points

  • Routes HTTP, gRPC, TCP, TLS, and HTTP/3 traffic.
  • Canary traffic shares are controlled through annotations.
  • State is stored in Kubernetes, without a separate database.
  • Client certificate validation and mutual TLS are supported.
  • Diagnostics service helps investigate configuration issues.

Limits

  • Deployment is self-hosted.
  • Installation requires Kubernetes; Helm is recommended.
  • Community questions and bug reports use separate channels.

Who it suits

Emissary-ingress is for developers and operators in cloud-native organizations whose developers have operational responsibility for their services. It suits teams deploying a self-hosted Kubernetes gateway.

Verdict

Emissary-ingress brings gateway routing, authentication, and traffic controls into a Kubernetes-native setup. It is a fit for teams prepared to self-host and manage its Kubernetes deployment.

Where Specifiction places it

Alternatives to Emissary-ingressAll alternatives →