Envoy Gateway vs NGINX Gateway Fabric

Envoy Gateway is a free, open-source application gateway for managing Envoy Proxy in standalone or Kubernetes-based deployments. It provisions and configures proxies through Kubernetes Gateway API resources, extending the API to expose Envoy features. Traffic management includes rate limiting, retries, circuit breaking, timeouts and failover. Security options include mTLS, JWT-based access control, OIDC integration and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during a TLS handshake. Metrics, access logging and distributed tracing are among its observability features. Installation options include Helm, Argo CD, Flux CD and Kubernetes YAML, though the quickstart requires a Kubernetes cluster. The project lists HTTP, HTTPS, gRPC, TLS, TCP and UDP support. Integrations and ecosystem projects include Envoy AI Gateway, Kuadrant, Knative, KServe and KEDA. Community help is directed through Envoy Slack, GitHub discussions and issues, and community meetings. Documentation cautions that the latest release includes recent main-branch commits and might not be stable.

NGINX Gateway Fabric is a self-hosted Kubernetes implementation of the Gateway API, using NGINX as its data plane for load balancing, reverse proxying, and API gateway use cases. Its control plane translates Gateway API resources into NGINX configuration. Supported resource coverage includes GatewayClass, Gateway, HTTPRoute, GRPCRoute, ReferenceGrant, TLSRoute, TCPRoute, UDPRoute, and BackendTLSPolicy, though the support level varies by resource. Traffic features include HTTP and TLS routing, redirects, rewrites, request mirroring, session persistence, and rate limiting. Security documentation covers HTTPS with cert-manager, mutual TLS, basic authentication, OpenID Connect, external authentication, and JWT authentication. Monitoring examples use Prometheus and Grafana; tracing uses OpenTelemetry collectors, including Jaeger examples. The free NGINX Open Source data-plane plan costs nothing. Installation is available through Helm from an OCI registry or from source, with Gateway API resources installed beforehand. Version 2.7.2 requires Kubernetes 1.32 or later; documented images are available for amd64 and arm64. Support is directed to GitHub issues and the NGINX Community Forum.