BFE Ingress Controller vs NGINX Gateway Fabric

BFE Ingress Controller is an open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End. It is self-hosted and supports Linux, macOS, Windows, and API use. BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI traffic; HTTP/3 is planned. Operators define content-based routing rules with a domain-specific language. Traffic features include global and distributed load balancing, zone-aware balancing, resilience to zone-level failures, and overload protection. Each tenant has an isolated configuration that is not visible to other tenants. A built-in plugin framework supports extensions for traffic management, security, and observability. For operations, BFE provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. The project lists integrations with mainstream Layer 4 load balancers and ecosystem projects such as Kubernetes, Prometheus, Jaeger, and Fluentd. It is licensed under Apache 2.0 and is a CNCF sandbox project. Documentation covers installation from source and through binary, Go, Snap, and Docker paths. The open-source plan is free.

NGINX Gateway Fabric is a self-hosted Kubernetes implementation of the Gateway API, using NGINX as its data plane for load balancing, reverse proxying, and API gateway use cases. Its control plane translates Gateway API resources into NGINX configuration. Supported resource coverage includes GatewayClass, Gateway, HTTPRoute, GRPCRoute, ReferenceGrant, TLSRoute, TCPRoute, UDPRoute, and BackendTLSPolicy, though the support level varies by resource. Traffic features include HTTP and TLS routing, redirects, rewrites, request mirroring, session persistence, and rate limiting. Security documentation covers HTTPS with cert-manager, mutual TLS, basic authentication, OpenID Connect, external authentication, and JWT authentication. Monitoring examples use Prometheus and Grafana; tracing uses OpenTelemetry collectors, including Jaeger examples. The free NGINX Open Source data-plane plan costs nothing. Installation is available through Helm from an OCI registry or from source, with Gateway API resources installed beforehand. Version 2.7.2 requires Kubernetes 1.32 or later; documented images are available for amd64 and arm64. Support is directed to GitHub issues and the NGINX Community Forum.