Airlock Microgateway vs NGINX Gateway Fabric

Airlock Microgateway is a Kubernetes-native Web Application and API Protection solution that also serves as an identity-aware proxy. It runs as a container in Kubernetes clusters and is configured through GitOps. The gateway supports Kubernetes Gateway API and is positioned as an upgrade from Ingress NGINX. It validates identities through OIDC, JWT, token exchange or mutual TLS, then applies role- and path-based access control. Protection features include deny rules, CSRF protection, OpenAPI specification enforcement and GraphQL validation against OWASP Top 10 threats. Its Envoy-based reverse proxy supports routing, TLS termination, client certificate authentication and caller IP forwarding. Integrations include Cilium and Istio, and the product is certified for Red Hat OpenShift. Prometheus and Grafana provide monitoring, while logs use ECS format. Deployment can be multi-cloud or hybrid-cloud, but remains self-hosted. Community Edition is free for small environments or local development, with enforced throughput and six-month license validity. The free evaluation license specifies 5 requests per second, at most two replicas per gateway and six-month validity. Premium Edition has no listed price and is intended for enterprise setups.

NGINX Gateway Fabric is a self-hosted Kubernetes implementation of the Gateway API, using NGINX as its data plane for load balancing, reverse proxying, and API gateway use cases. Its control plane translates Gateway API resources into NGINX configuration. Supported resource coverage includes GatewayClass, Gateway, HTTPRoute, GRPCRoute, ReferenceGrant, TLSRoute, TCPRoute, UDPRoute, and BackendTLSPolicy, though the support level varies by resource. Traffic features include HTTP and TLS routing, redirects, rewrites, request mirroring, session persistence, and rate limiting. Security documentation covers HTTPS with cert-manager, mutual TLS, basic authentication, OpenID Connect, external authentication, and JWT authentication. Monitoring examples use Prometheus and Grafana; tracing uses OpenTelemetry collectors, including Jaeger examples. The free NGINX Open Source data-plane plan costs nothing. Installation is available through Helm from an OCI registry or from source, with Gateway API resources installed beforehand. Version 2.7.2 requires Kubernetes 1.32 or later; documented images are available for amd64 and arm64. Support is directed to GitHub issues and the NGINX Community Forum.