Contour vs NGINX Gateway Fabric

Contour is a free, self-hosted, open-source Kubernetes ingress controller that provides the control plane for the Envoy edge and service proxy. It supports Kubernetes Ingress v1, its HTTPProxy custom resource and Gateway API. Contour updates ingress configuration dynamically with minimal dropped connections and supports multiple configuration types in clusters used by multiple teams. It can run as a Kubernetes deployment or daemonset, and administrators can delegate access to wildcard certificates. Documented security features include TLS termination, client authorization, rate limiting, JWT verification and IP filtering. Contour and Envoy expose metrics that Prometheus can scrape, and documentation includes guides for cert-manager, Gatekeeper and AWS Network Load Balancer. The project is tested with Kubernetes 1.21 and later and is intended for both cluster administrators and application developers. Community support is available through the project's GitHub page, where users can report issues or ask questions. Contour is a Cloud Native Computing Foundation incubating project; its documentation includes a threat model, a security reporting process and a security fix checklist.

NGINX Gateway Fabric is a self-hosted Kubernetes implementation of the Gateway API, using NGINX as its data plane for load balancing, reverse proxying, and API gateway use cases. Its control plane translates Gateway API resources into NGINX configuration. Supported resource coverage includes GatewayClass, Gateway, HTTPRoute, GRPCRoute, ReferenceGrant, TLSRoute, TCPRoute, UDPRoute, and BackendTLSPolicy, though the support level varies by resource. Traffic features include HTTP and TLS routing, redirects, rewrites, request mirroring, session persistence, and rate limiting. Security documentation covers HTTPS with cert-manager, mutual TLS, basic authentication, OpenID Connect, external authentication, and JWT authentication. Monitoring examples use Prometheus and Grafana; tracing uses OpenTelemetry collectors, including Jaeger examples. The free NGINX Open Source data-plane plan costs nothing. Installation is available through Helm from an OCI registry or from source, with Gateway API resources installed beforehand. Version 2.7.2 requires Kubernetes 1.32 or later; documented images are available for amd64 and arm64. Support is directed to GitHub issues and the NGINX Community Forum.