BFE Ingress Controller vs NGINX Ingress Controller

BFE Ingress Controller is an open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End. It is self-hosted and supports Linux, macOS, Windows, and API use. BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI traffic; HTTP/3 is planned. Operators define content-based routing rules with a domain-specific language. Traffic features include global and distributed load balancing, zone-aware balancing, resilience to zone-level failures, and overload protection. Each tenant has an isolated configuration that is not visible to other tenants. A built-in plugin framework supports extensions for traffic management, security, and observability. For operations, BFE provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. The project lists integrations with mainstream Layer 4 load balancers and ecosystem projects such as Kubernetes, Prometheus, Jaeger, and Fluentd. It is licensed under Apache 2.0 and is a CNCF sandbox project. Documentation covers installation from source and through binary, Go, Snap, and Docker paths. The open-source plan is free.

NGINX Ingress Controller is a self-hosted Kubernetes Ingress Controller for load balancing WebSocket, gRPC, TCP, and UDP applications. It provides content-based routing and TLS/SSL termination, with further NGINX settings exposed through annotations and ConfigMaps. Manifest installation can use Deployment, DaemonSet, or StatefulSet modes. Policy resources cover access control, rate limiting, API keys, authentication, mutual TLS, WAF, CORS, and HSTS, although some require NGINX Plus. The controller can expose NGINX and controller metrics in Prometheus format, including a ServiceMonitor with Prometheus Operator. Documented integrations include cert-manager, ExternalDNS, Prometheus, Istio, Linkerd, Open Service Mesh, and F5 products. The free NGINX Open Source plan costs nothing and requires a Kubernetes cluster. NGINX Plus requires a subscription and registry credentials, and adds metrics, balancing methods, persistence, health checks, and JWT validation.