- Home
- Kubernetes Ingress Controllers
- BFE Ingress Controller
BFE Ingress Controller
What it is
BFE Ingress Controller is a self-hosted, open-source Layer 7 load balancer derived from Baidu’s proprietary Baidu Front End. It handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI traffic; HTTP/3 is planned. Operators can use its domain-specific language to define content-based routing rules. BFE supports global and distributed load balancing, zone-aware balancing, resilience to zone-level failures, and overload protection. Tenant configurations are isolated from one another. Its plugin framework supports additions for traffic management, security, and observability. For operations, it provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. The project lists integrations with mainstream Layer 4 load balancers and Kubernetes, Prometheus, Jaeger, and Fluentd. BFE is available under the Apache 2.0 License and is a CNCF sandbox project. Installation paths include source, binaries, Go, Snap, and Docker. The open-source plan is free.
For and against
For
- Supports HTTP, HTTP/2, gRPC, and other listed protocols
- Offers zone-aware balancing and overload protection
- Isolated configuration for each tenant
- Includes metrics, logs, and distributed tracing
- Apache 2.0 licensed; plan is free
Against
- HTTP/3 is planned, not listed as supported
- Deployment model is self-hosted
The verdict
BFE combines Layer 7 traffic handling with routing rules, balancing controls, plugins, and operational visibility. It is a fit for teams able to run self-hosted software and work within its listed protocols and integrations.
Who it suits
BFE suits teams seeking a self-hosted load balancer with content-based routing, tenant isolation, and multiple traffic-management options. Its integrations and installation paths may also suit teams working with the listed ecosystem projects or deployment methods.
Plans and prices
Open source
Apache 2.0 license · no paid tiers stated
Read 15 Oct 2026 · bfe-networks.net
On the record
- API security warning
- Documentation says the management API should be reachable only from an internal network.bfe-networks.net · read 15 Oct 2026
- CNCF status
- BFE is a CNCF Sandbox project, a category CNCF describes as experimental and not yet widely tested in production.cncf.io · read 15 Oct 2026
- Company founded
- LinkedIn lists Baidu as founded in 2000 and having more than 10,001 employees.linkedin.com · read 15 Oct 2026
- Company ownership
- Baidu, Inc. is the company behind BFE; LinkedIn lists it as a public software company headquartered in Beijing.linkedin.com · read 15 Oct 2026
- Control plane
- The broader BFE system separates BFE Server from API Server, Conf Agent and Dashboard control-plane components.bfe-networks.net · read 15 Oct 2026
- Cookie routing
- Ingress traffic can be routed using cookie conditions.github.com · read 15 Oct 2026
- Documentation scope
- Ingress documentation includes deployment, RBAC, configuration, status, route priority, TLS, load balancing, redirects, rewrites, FAQ and annotations.github.com · read 15 Oct 2026
- Extensibility
- BFE offers Go plugin modules and a WebAssembly plugin path through a proxy-Wasm host.hysenlabs.com · read 15 Oct 2026
- Header routing
- Ingress traffic can be routed using HTTP header conditions.github.com · read 15 Oct 2026
- Host routing
- Ingress traffic can be routed using Host rules.github.com · read 15 Oct 2026
- Hot reload
- Configuration reloads are designed to avoid interrupting existing long-lived connections.github.com · read 15 Oct 2026
- Independent listing
- Kubernetes documentation lists BFE Ingress Controller as a third-party BFE-based controller and says Kubernetes does not maintain third-party controllers.kubernetes.io · read 15 Oct 2026
- Installation
- The documentation describes installing from source and provides binary, Go, Snap, and Docker installation paths.bfe-networks.net · read 7 Oct 2026
- Installation methods
- The project documents source, binary, Go, Snap and Docker installation paths.bfe-networks.net · read 15 Oct 2026
- Integrations
- Official documentation names Kubernetes, Prometheus, Jaeger, Fluentd and mainstream layer-4 load balancers as integrations.bfe-networks.net · read 15 Oct 2026
- Kubernetes API limit
- Kubernetes says the Ingress API is frozen and recommends Gateway API for new development.kubernetes.io · read 15 Oct 2026
- Kubernetes deployment
- The ingress controller can be installed with kubectl manifests or a Helm 3 chart.github.com · read 15 Oct 2026
- License
- BFE and the ingress controller are released under the Apache 2.0 license.github.com · read 15 Oct 2026
