Envoy Gateway vs kgateway
Envoy Gateway
gateway.envoyproxy.io
kgateway
kgateway.devSide by side
| Figure | Envoy Gateway | kgateway |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Linux | — | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Kubernetes Ingress Controllers | 7.9 (#9) | 7.0 (#22) |
| Installation | The documentation provides installation paths using Helm, Argo CD, Flux CD, and Kubernetes YAML. | The kgateway control plane installs into a Kubernetes cluster using Helm or Argo CD. |
| Integrations | The project lists integrations and ecosystem projects including Envoy AI Gateway, Kuadrant, Knative, KServe, and KEDA. | Documented integrations include Istio, AWS load balancers, Argo Rollouts, ExternalDNS, cert-manager, and OpenTelemetry. |
| Purpose | Envoy Gateway manages application and API traffic using Envoy Proxy as a standalone or Kubernetes-based API gateway. | Kgateway is a Kubernetes-native ingress controller and API gateway control plane that configures an Envoy data plane using the Kubernetes Gateway API. |
| Security | Its security controls include mTLS, JWT-based access control, OIDC integration, and API-key authorization. | Documented security features include TLS and mTLS, external authentication, API keys, JWT, OAuth2/OIDC, IP access control, and rate limiting. |
Plans
In their own words
Envoy Gateway
Envoy Gateway is a free, open-source application gateway for managing Envoy Proxy in standalone or Kubernetes-based deployments. It provisions and configures proxies through Kubernetes Gateway API resources, extending the API to expose Envoy features. Traffic management includes rate limiting, retries, circuit breaking, timeouts and failover. Security options include mTLS, JWT-based access control, OIDC integration and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during a TLS handshake. Metrics, access logging and distributed tracing are among its observability features. Installation options include Helm, Argo CD, Flux CD and Kubernetes YAML, though the quickstart requires a Kubernetes cluster. The project lists HTTP, HTTPS, gRPC, TLS, TCP and UDP support. Integrations and ecosystem projects include Envoy AI Gateway, Kuadrant, Knative, KServe and KEDA. Community help is directed through Envoy Slack, GitHub discussions and issues, and community meetings. Documentation cautions that the latest release includes recent main-branch commits and might not be stable.