Contour
What it is
Contour is a free, open-source Kubernetes ingress controller that provides the control plane for the Envoy edge and service proxy. It accepts Kubernetes Ingress v1, the HTTPProxy custom resource, and Gateway API, and updates ingress configuration dynamically with minimal dropped connections. For clusters used by multiple teams, it supports different ingress configuration types and can run as a Kubernetes deployment or daemonset. Administrators can securely delegate access to wildcard certificates. Documented security features include TLS termination, client authorization, rate limiting, JWT verification, and IP filtering. Contour and Envoy expose metrics for Prometheus scraping, and the documentation includes integration guides for cert-manager, Gatekeeper, and AWS Network Load Balancer. The project is tested with Kubernetes clusters running version 1.21 and later. It is self-hosted and provides community support through its GitHub project page; Contour is also a Cloud Native Computing Foundation incubating project.
For and against
For
- Supports Ingress v1, HTTPProxy, and Gateway API
- Can run as a deployment or daemonset
- Includes documented access and traffic controls
- Free and open source
Against
- Self-hosted deployment only
- Community support through GitHub
- Tested with Kubernetes 1.21 and later
The verdict
Contour offers multiple ingress configuration APIs and documented security controls for self-hosted Kubernetes environments. Teams should account for the Kubernetes version guidance and community-based support model.
Who it suits
Contour is designed for Kubernetes cluster administrators and application developers, particularly in multi-team clusters. It suits teams prepared to self-host and use community support.
Plans and prices
Contour
Open source Kubernetes ingress controller · community support
Read 3 Oct 2026 · projectcontour.io
On the record
- Deployment
- Contour can be deployed as a Kubernetes deployment or daemonset.projectcontour.io · read 3 Oct 2026
- Dynamic updates
- Contour dynamically updates ingress configuration with minimal dropped connections.projectcontour.io · read 3 Oct 2026
- Ingress configuration
- Contour supports Kubernetes Ingress v1, its HTTPProxy custom resource, and Gateway API.projectcontour.io · read 3 Oct 2026
- Integrations
- Contour documentation includes guides for cert-manager, Gatekeeper, AWS Network Load Balancer, and Prometheus metrics.projectcontour.io · read 3 Oct 2026
- Kubernetes versions
- Contour is tested with Kubernetes clusters running version 1.21 and later.projectcontour.io · read 3 Oct 2026
- Multi-team clusters
- Contour supports multiple types of ingress configuration in multi-team Kubernetes clusters.projectcontour.io · read 3 Oct 2026
- Observability
- Contour and Envoy expose metrics that can be scraped with Prometheus.projectcontour.io · read 3 Oct 2026
- Project status
- Contour is a Cloud Native Computing Foundation incubating project.projectcontour.io · read 3 Oct 2026
- Purpose
- Contour is an open source Kubernetes ingress controller that provides the control plane for the Envoy edge and service proxy.projectcontour.io · read 3 Oct 2026
- Security documentation
- Contour documentation provides a threat model and security posture page, a security report process, and a security fix checklist.projectcontour.io · read 3 Oct 2026
- Security features
- The documentation lists TLS termination and delegation, client authorization, rate limiting, JWT verification, and IP filtering features.projectcontour.io · read 3 Oct 2026
- Support
- The project provides community support through its GitHub project page and invites users to file issues or ask questions there.projectcontour.io · read 3 Oct 2026
- Target users
- Contour is designed to serve both cluster administrators and application developers.projectcontour.io · read 3 Oct 2026
- TLS delegation
- Administrators can securely delegate wildcard certificate access.projectcontour.io · read 3 Oct 2026
