BFE Ingress Controller vs Higress
BFE Ingress Controller
bfe-networks.net
Higress
higress.ioSide by side
| Figure | BFE Ingress Controller | Higress |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 5 |
| Spec score · Kubernetes Ingress Controllers | 9.0 (#2) | 8.6 (#4) |
| CNCF status | BFE is a CNCF Sandbox project, a category CNCF describes as experimental and not yet widely tested in production. | CNCF announced that Higress passed its TOC vote and joined the CNCF Sandbox on March 25, 2026. |
| Limit: operational complexity | Independent analysis says a fleet with API, UI and configuration management requires four separate deployments because the data plane and control-plane components are split. | The same evaluation judged Higress better suited to Kubernetes platform teams than developers expecting a conventional plain go mod installation. |
| Observability | Built-in metrics, logs and distributed tracing are provided for operations and troubleshooting. | The AI statistics plugin records token counts, first-token latency, total request latency and logs across gateway, route, service and model dimensions. |
| Security | The vendor says BFE is written in Go, a memory-safe language, and describes it as immune to buffer overflow vulnerabilities. | Listed protections include prompt-attack detection, sensitive-content identification, data privacy protection, and output-content filtering. |
| Security reporting | Security vulnerabilities should be reported privately to [email protected]. | The security policy directs vulnerability reports to GitHub Private Security Advisories and states that supported major lines are 2.x and 1.x. |
| Support | The project directs questions and issues to GitHub and lists CNCF Slack and WeChat community channels. | The community edition includes community support and documentation; the dedicated commercial edition lists ticket, DingTalk group, and offline support. |
| What it does | BFE Ingress Controller implements Kubernetes Ingress on top of the BFE layer-7 load balancer. | Higress is an open-source, AI-native cloud API gateway built on Istio and Envoy. |
Plans
Higress
- Alibaba Cloud AI Gateway Serverless StandardPriced on request
- Higress CommunityFree
- Higress Community EditionFree
- Alibaba Cloud AI Gateway Serverless EnterprisePriced on request
- Feitian Exclusive EditionPriced on request
In their own words
BFE Ingress Controller
BFE Ingress Controller is an open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End. It is self-hosted and supports Linux, macOS, Windows, and API use. BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI traffic; HTTP/3 is planned. Operators define content-based routing rules with a domain-specific language. Traffic features include global and distributed load balancing, zone-aware balancing, resilience to zone-level failures, and overload protection. Each tenant has an isolated configuration that is not visible to other tenants. A built-in plugin framework supports extensions for traffic management, security, and observability. For operations, BFE provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. The project lists integrations with mainstream Layer 4 load balancers and ecosystem projects such as Kubernetes, Prometheus, Jaeger, and Fluentd. It is licensed under Apache 2.0 and is a CNCF sandbox project. Documentation covers installation from source and through binary, Go, Snap, and Docker paths. The open-source plan is free.
Higress
Higress is an open-source API gateway for governing AI services and cloud-native traffic, built on Istio and Envoy. Its AI Gateway provides centralized access to model APIs and MCP servers, with unified routing, protocol conversion, load balancing, and fallback. Higress says it supports more than 100 mainstream large language models. It can convert HTTP to MCP and proxy native MCP services. Traffic controls include token-based quotas and rate limits, API key pool rotation, and consumer authentication. Caching can reuse inference results precisely or semantically to reduce token use and latency for similar or repeated questions. Listed security measures cover prompt attacks, sensitive content, data privacy, and output filtering. The wider API gateway combines traffic, microservice, and security gateway functions with service exposure and API lifecycle management. It supports HTTP, HTTP2, HTTPS, GRPC, GRPCS, TCP, and Dubbo, along with Kubernetes Ingress and Gateway API. Custom Wasm plugins can be written in Go, Rust, or JavaScript, with sandbox isolation and hot updates. The self-hosted Community Edition is free; the site also lists a managed Alibaba Cloud plan billed by actual usage, starting at ¥0.