Envoy Gateway vs HAProxy Ingress
Envoy Gateway
gateway.envoyproxy.io
HAProxy Ingress
haproxy-ingress.github.ioSide by side
| Figure | Envoy Gateway | HAProxy Ingress |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Linux | — | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Kubernetes Ingress Controllers | 7.9 (#9) | 7.6 (#13) |
| Deployment | The project can manage Envoy Proxy as a standalone or Kubernetes-based application gateway. | The controller is installed and configured with a Helm chart, and the instructions require Helm version 3. |
| Gateway API | Envoy Gateway implements the Kubernetes Gateway API and extends it to expose Envoy features through Gateway API resources. | The Gateway API documentation says HAProxy Ingress can manage Ingress and Gateway API resources in the same cluster, with support described as partial. |
| Purpose | Envoy Gateway manages application and API traffic using Envoy Proxy as a standalone or Kubernetes-based API gateway. | HAProxy Ingress configures HAProxy to route incoming requests from an external network to applications in a Kubernetes cluster. |
| Security | Its security controls include mTLS, JWT-based access control, OIDC integration, and API-key authorization. | The getting-started guide says HAProxy Ingress uses TLS SNI and the Host header to associate requests with ingress hosts. |
Plans
In their own words
Envoy Gateway
Envoy Gateway is a free, open-source application gateway for managing Envoy Proxy in standalone or Kubernetes-based deployments. It provisions and configures proxies through Kubernetes Gateway API resources, extending the API to expose Envoy features. Traffic management includes rate limiting, retries, circuit breaking, timeouts and failover. Security options include mTLS, JWT-based access control, OIDC integration and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during a TLS handshake. Metrics, access logging and distributed tracing are among its observability features. Installation options include Helm, Argo CD, Flux CD and Kubernetes YAML, though the quickstart requires a Kubernetes cluster. The project lists HTTP, HTTPS, gRPC, TLS, TCP and UDP support. Integrations and ecosystem projects include Envoy AI Gateway, Kuadrant, Knative, KServe and KEDA. Community help is directed through Envoy Slack, GitHub discussions and issues, and community meetings. Documentation cautions that the latest release includes recent main-branch commits and might not be stable.
HAProxy Ingress
HAProxy Ingress is a free, self-hosted controller that configures HAProxy to route external requests to applications in a Kubernetes cluster. It applies changes made in the cluster to HAProxy without requiring a separate update process. The project supports Ingress and Gateway API resources and describes more than 200 configuration options. Gateway API support is partial: the documented implementation covers GatewayClass, Gateway, TCPRoute, and HTTPRoute, but not HTTPRoute filters or resource status updates. Installation uses a Helm chart and requires Helm 3, a running Kubernetes cluster, and administrative privileges in that cluster. Version 0.16 requires Kubernetes 1.21 or newer. Local cluster options named by the project include minikube, kind, k3s, k3d, and colima. It associates requests with ingress hosts using TLS SNI and the Host header. Metrics can be collected with Prometheus and Grafana using Prometheus Operator. The project uses the Apache-2.0 license and lists community channels including Slack, a users mailing list, and Stack Overflow.