Envoy Gateway

Envoy Gateway is an open-source application gateway that manages Envoy Proxy in standalone or Kubernetes-based deployments. It uses Kubernetes Gateway API resources to provision and configure proxies, extending those resources to expose Envoy features. Traffic management options include rate limiting, retries, circuit breaking, timeouts, and failover. Security controls include mTLS, JWT-based access control, OIDC integration, and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during the handshake. Metrics, access logging, and distributed tracing provide observability options. Installation paths include Helm, Argo CD, Flux CD, and Kubernetes YAML, while the quickstart requires a Kubernetes cluster. Supported protocols include HTTP, HTTPS, gRPC, TLS, TCP, and UDP. The project is free at no cost and uses the Apache-2.0 license. Its documentation cautions that the latest release contains recent main-branch commits and might not be stable.

Envoy Gateway combines proxy configuration with traffic management, security, and observability features. Check the release stability caveat and Kubernetes prerequisite before choosing an installation path.

Envoy Gateway suits teams managing Envoy Proxy as a standalone or Kubernetes-based gateway. It is aimed at users comfortable with self-hosted deployments and, for the quickstart, a Kubernetes cluster.

Envoy Gateway is a free, open-source control plane for operating Envoy Proxy as a standalone or Kubernetes-based application gateway. It suits platform and infrastructure teams that want Gateway API configuration, broad protocol support, and the freedom to shape policies themselves. The trade-off is operational ownership, plus a Kubernetes requirement for the quickstart and a release channel that may include unstable recent commits.

Overview

Envoy Gateway turns Kubernetes Gateway API resources into configured Envoy proxies, while also supporting standalone deployment. That makes it a practical foundation for teams standardizing gateway behavior across environments they run themselves, rather than buyers looking for a hosted gateway with vendor-managed operations. The project is Apache-2.0 licensed and open source, so there is no software charge, but deployment, upgrades, certificates, and policy design remain your responsibility.

The quickstart requires a Kubernetes cluster. Documentation also covers Helm, Argo CD, Flux CD, and Kubernetes YAML installation paths. Before adopting a release, account for the documentation warning that the latest version contains recent main-branch commits and might not be stable.

Key features

Gateway configuration and traffic control

Gateway API resources provide a familiar Kubernetes-native configuration layer, with extensions that expose Envoy-specific capabilities. The control plane is designed for custom policies, specialized solutions, and further extensions, which is valuable for platform teams with requirements that do not fit a fixed gateway product.

Traffic management includes rate limiting, retries, circuit breaking, timeouts, and failover. These controls cover overload, transient failure, and upstream availability scenarios, but a self-hosted implementation means your team must choose sensible policies and operate them. Request transformation is supported as well.

Protocols, security, and TLS

Envoy Gateway supports HTTP, HTTPS, gRPC, TLS, TCP, and UDP, giving one gateway layer a wide protocol remit. Authentication and authorization options include mTLS, JWT, API keys, Basic Auth, OIDC, and external authorization. TLS termination is supported, and a Gateway certificate Secret can supply an OCSP response during the TLS handshake. This is a substantial security toolkit for organizations that can manage its configuration; it is less suitable when you want security controls abstracted behind a managed service.

Observability and ecosystem

Metrics, access logging, and distributed tracing provide the signals needed to investigate traffic and policy behavior. Listed integrations include Envoy AI Gateway, Kuadrant, Knative, KServe, and KEDA, extending the potential fit for teams already using those projects. Community help is directed through Envoy Slack, GitHub discussions and issues, and community meetings.

Pricing

The Envoy Gateway plan costs free. It is the open-source project, Apache-2.0 licensed, with a self-hosted deployment model and standalone or Kubernetes-based application-gateway use. There is no free trial because the product is already free, and no seat, request, or usage quota is stated for this plan. The price advantage is clear for teams able to provide their own infrastructure and support; it does not remove those operating costs.

Platforms

Envoy Gateway is offered for API and self-hosted use. Deployment can be standalone or Kubernetes-based, with the quickstart specifically requiring a Kubernetes cluster. Supported protocols are HTTP, HTTPS, gRPC, TLS, TCP, and UDP.

Who it's for

Choose Envoy Gateway if your organization runs Kubernetes or other self-managed infrastructure, wants a Gateway API-centered control plane, and needs to combine traffic policy, authentication, TLS, and observability in an extensible Envoy-based stack. It is especially well matched to platform engineering groups that can maintain custom policies and integrations.

Look elsewhere if you need a fully managed gateway, a vendor-defined support contract bundled with the software, or a quickstart that does not depend on Kubernetes. Teams with low tolerance for release instability should also evaluate the current release carefully.

Pros and cons

• Pro: No software license cost and Apache-2.0 open-source licensing make self-hosted adoption straightforward.
• Pro: Gateway API resources plus extensions provide Kubernetes-native configuration without giving up Envoy-specific controls.
• Pro: Broad protocol coverage and strong security choices, including mTLS, OIDC, JWT, API keys, and external authorization.
• Pro: Rate limiting, retries, circuit breaking, timeouts, failover, transformations, metrics, logs, and tracing cover core gateway operations.
• Con: The quickstart requires Kubernetes, narrowing its appeal for teams without a cluster.
• Con: Self-hosting shifts upgrades, reliability, certificates, and policy administration to your team.
• Con: The latest release may contain unstable main-branch commits, which raises release-management risk.

Alternatives

For a broader starting point, browse API Gateway Software or Kubernetes Ingress Controllers. Choose Amazon API Gateway instead when you want a paid AWS service with a free tier and Android, iOS, web, and API platforms. Gravitee API Gateway is a fit when a freemium model and a free Apache 2.0 Community Edition are preferable, with a listed Planet plan at $2,500 a month.

Kong Gateway suits buyers wanting a 30-day free trial with no credit card, no Gateway limits, and 30 days of analytics retention. Google Cloud Endpoints is worth considering for a usage-tier model that includes 1,999,999 free API calls and a $3 monthly standard tier. Higress offers a free self-hosted Community Edition with community support while the user handles stability and performance.

KrakenD API Gateway provides a free self-hosted Community Edition with unlimited requests, APIs, and AI workloads. Lura is a free Go library compiled from source, while Spring Integration is a free Apache-2.0 Java/Spring application dependency.

Verdict

Envoy Gateway is a strong choice for infrastructure teams that want a free, extensible Envoy gateway governed through Gateway API resources and operated on their own platforms. Its main reason to choose it is the combination of comprehensive traffic, security, protocol, and observability controls without a license fee. Its main reason to look elsewhere is the operational burden: Kubernetes is required for the quickstart, self-hosting is mandatory, and the latest release may not be stable.