Envoy Gateway vs F5 BIG-IP Container Ingress Services
Envoy Gateway
gateway.envoyproxy.io
F5 BIG-IP Container Ingress Services
clouddocs.f5.comSide by side
| Figure | Envoy Gateway | F5 BIG-IP Container Ingress Services |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Kubernetes Ingress Controllers | 7.9 (#9) | 7.8 (#10) |
| Observability | The project lists metrics, access logging, and distributed tracing as observability features. | BIG-IP data streams can export application and network statistics to third-party visibility and analytics tools, with Splunk given as an example. |
| Purpose | Envoy Gateway manages application and API traffic using Envoy Proxy as a standalone or Kubernetes-based API gateway. | CIS integrates container orchestration environments with F5 BIG-IP to dynamically create L4/L7 services and load balance traffic as container applications change. |
| Security | Its security controls include mTLS, JWT-based access control, OIDC integration, and API-key authorization. | F5 documents securing CIS BIG-IP credentials by storing them in HashiCorp Vault and synchronizing them to a Kubernetes Secret with External Secrets Operator. |
| Traffic management | The project lists rate limiting, retries, circuit breaking, timeouts, and failover among its traffic management capabilities. | CIS supports HTTP and URI routing, load balancing, scaling, health monitoring, and Blue/Green and A/B traffic management for app versions. |
Plans
F5 BIG-IP Container Ingress Services
- Open-source softwareFree
In their own words
Envoy Gateway
Envoy Gateway is a free, open-source application gateway for managing Envoy Proxy in standalone or Kubernetes-based deployments. It provisions and configures proxies through Kubernetes Gateway API resources, extending the API to expose Envoy features. Traffic management includes rate limiting, retries, circuit breaking, timeouts and failover. Security options include mTLS, JWT-based access control, OIDC integration and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during a TLS handshake. Metrics, access logging and distributed tracing are among its observability features. Installation options include Helm, Argo CD, Flux CD and Kubernetes YAML, though the quickstart requires a Kubernetes cluster. The project lists HTTP, HTTPS, gRPC, TLS, TCP and UDP support. Integrations and ecosystem projects include Envoy AI Gateway, Kuadrant, Knative, KServe and KEDA. Community help is directed through Envoy Slack, GitHub discussions and issues, and community meetings. Documentation cautions that the latest release includes recent main-branch commits and might not be stable.
F5 BIG-IP Container Ingress Services
F5 BIG-IP Container Ingress Services (CIS) connects Kubernetes and Red Hat OpenShift environments with F5 BIG-IP. It watches Kubernetes resources and adjusts BIG-IP configuration as applications change, while teams manage BIG-IP through Kubernetes or OpenShift command-line interfaces and APIs. CIS can send traffic from BIG-IP to clusters through NodePort or ClusterIP and supports F5 AS3 declarations. It provides HTTP and URI routing, load balancing, scaling, health monitoring, and Blue/Green or A/B traffic handling. F5 documents Ingress resources, OpenShift Routes, IngressLink coordination with NGINX Ingress Controller, and overlays including OpenShift SDN, Flannel, and Calico. BIG-IP data streams can export application and network statistics to tools such as Splunk. Installation is available through Helm or manual methods, with releases on Docker Hub and Red Hat Container Registry. The open-source plan is free, but requires a licensed BIG-IP system, a Kubernetes or OpenShift cluster, and AS3 installed on BIG-IP.