Envoy Gateway vs NGINX Ingress Controller

Envoy Gateway is a free, open-source application gateway for managing Envoy Proxy in standalone or Kubernetes-based deployments. It provisions and configures proxies through Kubernetes Gateway API resources, extending the API to expose Envoy features. Traffic management includes rate limiting, retries, circuit breaking, timeouts and failover. Security options include mTLS, JWT-based access control, OIDC integration and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during a TLS handshake. Metrics, access logging and distributed tracing are among its observability features. Installation options include Helm, Argo CD, Flux CD and Kubernetes YAML, though the quickstart requires a Kubernetes cluster. The project lists HTTP, HTTPS, gRPC, TLS, TCP and UDP support. Integrations and ecosystem projects include Envoy AI Gateway, Kuadrant, Knative, KServe and KEDA. Community help is directed through Envoy Slack, GitHub discussions and issues, and community meetings. Documentation cautions that the latest release includes recent main-branch commits and might not be stable.

NGINX Ingress Controller is a self-hosted Kubernetes Ingress Controller for load balancing WebSocket, gRPC, TCP, and UDP applications. It provides content-based routing and TLS/SSL termination, with further NGINX settings exposed through annotations and ConfigMaps. Manifest installation can use Deployment, DaemonSet, or StatefulSet modes. Policy resources cover access control, rate limiting, API keys, authentication, mutual TLS, WAF, CORS, and HSTS, although some require NGINX Plus. The controller can expose NGINX and controller metrics in Prometheus format, including a ServiceMonitor with Prometheus Operator. Documented integrations include cert-manager, ExternalDNS, Prometheus, Istio, Linkerd, Open Service Mesh, and F5 products. The free NGINX Open Source plan costs nothing and requires a Kubernetes cluster. NGINX Plus requires a subscription and registry credentials, and adds metrics, balancing methods, persistence, health checks, and JWT validation.