Envoy Gateway vs Traefik Proxy
Envoy Gateway
gateway.envoyproxy.io
Traefik Proxy
traefik.ioSide by side
| Figure | Envoy Gateway | Traefik Proxy |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 4 |
| Spec score · Kubernetes Ingress Controllers | 7.9 (#9) | 8.2 (#6) |
| Extensibility | The control plane is designed to support custom policies, specialized solutions, and extensions. | Traefik supports WebAssembly plugins and provides a public plugin catalog. |
| Integrations | The project lists integrations and ecosystem projects including Envoy AI Gateway, Kuadrant, Knative, KServe, and KEDA. | The project identifies Docker, Docker Swarm, Kubernetes, Consul, Etcd, Rancher and Amazon ECS among its supported infrastructure integrations. |
| Observability | The project lists metrics, access logging, and distributed tracing as observability features. | Proxy includes real-time logs, access logs, metrics and distributed tracing. |
| Purpose | Envoy Gateway manages application and API traffic using Envoy Proxy as a standalone or Kubernetes-based API gateway. | Traefik is an open-source reverse proxy and ingress controller for deploying services and APIs. |
| Security | Its security controls include mTLS, JWT-based access control, OIDC integration, and API-key authorization. | Traefik provides automatic HTTPS, Let’s Encrypt support, custom certificates, authentication, and Web Application Firewall support. |
| Traffic management | The project lists rate limiting, retries, circuit breaking, timeouts, and failover among its traffic management capabilities. | Features include Layer 4 and Layer 7 routing, mirroring, blue-green and canary deployments, stickiness, and active health checks. |
Plans
Traefik Proxy
- Traefik ProxyFree
- Traefik Proxy Open SourceFree
- Traefik Hub API GatewayPriced on request
- Traefik Hub API ManagementPriced on request
In their own words
Envoy Gateway
Envoy Gateway is a free, open-source application gateway for managing Envoy Proxy in standalone or Kubernetes-based deployments. It provisions and configures proxies through Kubernetes Gateway API resources, extending the API to expose Envoy features. Traffic management includes rate limiting, retries, circuit breaking, timeouts and failover. Security options include mTLS, JWT-based access control, OIDC integration and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during a TLS handshake. Metrics, access logging and distributed tracing are among its observability features. Installation options include Helm, Argo CD, Flux CD and Kubernetes YAML, though the quickstart requires a Kubernetes cluster. The project lists HTTP, HTTPS, gRPC, TLS, TCP and UDP support. Integrations and ecosystem projects include Envoy AI Gateway, Kuadrant, Knative, KServe and KEDA. Community help is directed through Envoy Slack, GitHub discussions and issues, and community meetings. Documentation cautions that the latest release includes recent main-branch commits and might not be stable.
Traefik Proxy
Traefik Proxy is a free, open-source reverse proxy and ingress controller for deploying services and APIs. It discovers services and adjusts routing dynamically, supporting HTTP, HTTP/2, HTTP/3, TCP, UDP, WebSockets, and gRPC. Traffic controls include Layer 4 and Layer 7 routing, mirroring, blue-green and canary deployments, stickiness, and active health checks. Security options include automatic HTTPS, Let’s Encrypt, custom certificates, authentication, and Web Application Firewall support. Integrations span Kubernetes, Docker, Docker Swarm, Red Hat OpenShift, Rancher, Amazon ECS, Consul, and key-value stores. It supports deployment on environments including Kubernetes distributions, virtual machines, bare metal, Docker Swarm, and HashiCorp Nomad. Observability includes OpenTelemetry, a built-in dashboard, distributed tracing, and metrics integrations. WebAssembly plugins and a public plugin catalog provide extension options. Traefik Proxy is self-hosted and listed for Linux, macOS, and Windows. The plan is free; Traefik Labs also offers commercial support with expert assistance available 24/7/365.