Airlock Microgateway vs BFE Ingress Controller

Airlock Microgateway is a Kubernetes-native Web Application and API Protection solution that also serves as an identity-aware proxy. It runs as a container in Kubernetes clusters and is configured through GitOps. The gateway supports Kubernetes Gateway API and is positioned as an upgrade from Ingress NGINX. It validates identities through OIDC, JWT, token exchange or mutual TLS, then applies role- and path-based access control. Protection features include deny rules, CSRF protection, OpenAPI specification enforcement and GraphQL validation against OWASP Top 10 threats. Its Envoy-based reverse proxy supports routing, TLS termination, client certificate authentication and caller IP forwarding. Integrations include Cilium and Istio, and the product is certified for Red Hat OpenShift. Prometheus and Grafana provide monitoring, while logs use ECS format. Deployment can be multi-cloud or hybrid-cloud, but remains self-hosted. Community Edition is free for small environments or local development, with enforced throughput and six-month license validity. The free evaluation license specifies 5 requests per second, at most two replicas per gateway and six-month validity. Premium Edition has no listed price and is intended for enterprise setups.

BFE Ingress Controller is an open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End. It is self-hosted and supports Linux, macOS, Windows, and API use. BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI traffic; HTTP/3 is planned. Operators define content-based routing rules with a domain-specific language. Traffic features include global and distributed load balancing, zone-aware balancing, resilience to zone-level failures, and overload protection. Each tenant has an isolated configuration that is not visible to other tenants. A built-in plugin framework supports extensions for traffic management, security, and observability. For operations, BFE provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. The project lists integrations with mainstream Layer 4 load balancers and ecosystem projects such as Kubernetes, Prometheus, Jaeger, and Fluentd. It is licensed under Apache 2.0 and is a CNCF sandbox project. Documentation covers installation from source and through binary, Go, Snap, and Docker paths. The open-source plan is free.