Emissary-ingress vs Traefik Hub API Gateway

Emissary-ingress is a free, open-source Kubernetes API gateway, Layer 7 load balancer, and Ingress built on Envoy Proxy. It handles HTTP, HTTPS, HTTP proxy, HTTPS proxy, TCP, TLS, gRPC, and HTTP/3 traffic. Developers can add, remove, merge, or separate services through Kubernetes resources or annotations, and use annotations to control traffic shares for canary deployments. Emissary stores state in Kubernetes rather than requiring a separate database, with Envoy handling routing and proxying. It can check requests through an external authentication service and a third-party rate limit service, and supports request transformation and client certificate validation, including mutual TLS. A diagnostics service helps investigate configuration issues. Emissary can act as an Istio edge proxy and supports Consul service discovery. It is self-hosted on Linux; Helm is the recommended installation method, with Kubernetes YAML also documented. The project is intended for cloud-native organizations where developers operate their services, as well as developers and operators.

Traefik Hub API Gateway is a hybrid gateway for managing and securing APIs and microservices. It discovers services and adjusts routing when services are deployed or removed, with Kubernetes service discovery, Helm charts, Gateway API, and declarative configuration through Kubernetes resources and CRDs. It supports HTTP, HTTP/2, TCP, UDP, WebSockets, and gRPC, alongside rate limiting, request transformation, HTTP caching, canary deployments, and graceful configuration reloads.

Security options include JWT, OAuth2, OIDC, LDAP, API keys, HMAC, and Open Policy Agent, as well as TLS management and a Web Application Firewall powered by OWASP Coraza. The feature matrix lists FIPS 140-3 compliance. API management includes an inventory, versioning, plans and bundles, subscriptions, and a developer portal with interactive testing and access-credential generation. GitOps tools such as Flux and Argo are supported. The product is stateless and horizontally scalable, and integrates with HashiCorp Vault and OpenTelemetry. It is intended for DevOps and Platform Engineering teams. Pricing is available on request; there is no free plan, though a free trial is offered without a stated duration.