Contour

Contour is a Kubernetes ingress controller that manages external HTTP and TCP traffic by orchestrating Envoy proxy instances. It functions as a control plane that translates declarative Kubernetes API objects into dynamic proxy configurations, enabling real-time traffic management without requiring infrastructure restarts.

The system distinguishes itself through a focus on multi-tenant cluster networking and delegated configuration. By allowing routing rules to be partitioned across namespaces, it enables multiple teams to securely manage their own traffic policies within a shared cluster. It further supports complex environments by offloading authentication and access control decisions to external services and providing granular control over virtual hosts and credentials.

Beyond core routing, the project provides a comprehensive suite of traffic management and security capabilities. This includes advanced load balancing, circuit breaking, rate limiting, and TLS termination, alongside robust observability features such as distributed request tracing, structured access logging, and active backend health monitoring. The controller ensures high availability through leader election coordination and validates configuration objects during initialization to prevent runtime errors.

Features

Ingress Gateways - Manages external HTTP and TCP traffic routing into Kubernetes clusters using Envoy proxy instances.
Envoy-Based Proxies - Uses a high-performance Envoy proxy to handle L7 routing, TLS termination, and load balancing for inbound network traffic.
Ingress-Based Routing - Manages cluster traffic routing using standard interfaces and custom resource definitions.
Proxy Orchestrators - Translates cluster resources into dynamic configurations pushed to proxy instances for real-time traffic control.
Traffic Orchestration - Orchestrates complex traffic routing, TLS termination, and load balancing policies for containerized applications.
Ingress Controllers - Functions as a Kubernetes ingress controller that manages external traffic routing via Envoy proxy instances.
Kubernetes API Gateways - Acts as a cloud-native API gateway providing advanced traffic management and security for Kubernetes services.
Load Balancing Strategies - Distributes traffic using strategies like Round Robin or Weighted Least Request to ensure efficient resource utilization.
Virtual Host Routing - Directs incoming requests to backend services based on virtual hosts, paths, and headers.
Circuit Breakers - Prevents cascading failures by stopping traffic to failing services based on configurable thresholds.
API Gateway Security - Enforces security policies like JWT validation and IP filtering at the network edge to protect backend services.
SSL/TLS Termination - Decrypts secure connections at the edge before forwarding traffic to internal services.
Namespace Isolation Policies - Restricts which namespaces can configure virtual hosts and credentials to ensure security in shared clusters.
Delegated - Enables multi-team environments by partitioning routing rules across namespaces for decentralized management.
Real-Time Runtime Updates - Applies routing changes to the proxy layer in real time without requiring a restart of the underlying infrastructure.
Request Path Rewriters - Modifies URL paths of incoming requests to ensure they match the expected format of backend services.
Request Retries - Automatically re-attempts failed requests to backend services based on configurable conditions and limits to improve resilience.
Ingress Provisioners - Automates the deployment and lifecycle of proxy instances by monitoring standard resources to dynamically scale traffic entry points.
Custom Resource Mappings - Translates Kubernetes API objects into Envoy proxy configuration via a specialized translation layer.
Dynamic Configuration Updates - Pushes routing updates to proxy instances using persistent sessions to avoid infrastructure restarts.
High Availability Control Planes - Ensures only one active controller instance manages the configuration delivery plane to prevent conflicting state updates.
High Availability Infrastructure - Maintains configuration delivery during node or zone failures by using leader election and load-balanced management instances.
Leader Election - Maintains high availability of the management plane by ensuring only one instance controls configuration delivery at any time.
Ingress Class Selectors - Assigns specific ingress resources to controller instances using class identifiers to allow coexistence.
Kubernetes Traffic Controllers - Orchestrates complex traffic rules, TLS termination, and rate limiting through custom Kubernetes resources.
Request Rate Limiting - Restricts request volume using local counters or external services to prevent backend service overload.
External Load-Balancer Integrations - Connects to cloud network load balancers using the standard protocol to preserve original client IP addresses.
Request Timeout Management - Enforces response deadlines and idle connection limits to prevent resource exhaustion during slow service responses.
Configuration Managers - Translates Kubernetes resources into dynamic configurations for Envoy to handle L7 routing and load balancing.
Dynamic Reverse Proxies - Distributes dynamic configuration to proxy instances using a persistent session to ensure seamless updates.
IP Address Filtering - Restricts network access to the cluster based on allowed IP addresses or CIDR ranges.
Multi-Protocol Support - Supports specialized communication patterns including WebSockets, gRPC, and the PROXY protocol.
Daemon Proxy Deployments - Installs proxy instances as node-local daemons or scaled deployments to optimize performance and manage connection draining.
TCP Proxies - Forwards raw TCP traffic to backend services to support non-HTTP protocols and specialized network applications.
Namespace-Based Routing Delegation - Enables multiple teams to securely manage their own traffic policies within a shared cluster by delegating routing rules across namespaces.
External Authorization Proxies - Delegates request authorization decisions to external services to support custom access control logic.
Access Control and Authorization - Defines authorization settings and custom metadata for virtual hosts and routes to control service access.
External Service Authorizers - Intercepts incoming requests and offloads authentication and access control decisions to specialized third-party services.
Namespace-Based Isolation - Restricts the ability to configure virtual hosts and credentials to specific namespaces to ensure security in multi-tenant environments.
JWT Token Validators - Verifies the authenticity and expiration of JSON Web Tokens for secure access control.
TLS Certificate Management - Automates the provisioning and application of TLS certificates for secure ingress communication.
HTTPS Redirection Policies - Enforces encrypted connections by redirecting insecure HTTP traffic to HTTPS.
Configuration Streams - Streams routing updates to proxy instances over persistent connections to enable seamless changes without restarting network services.
Routing Delegation Policies - Partitions routing rules across cluster boundaries to allow multiple teams to manage their own traffic policies securely.
Routing Configurations - Verifies routing configuration objects during initialization to prevent runtime failures from invalid path definitions.
Distributed Observability Systems - Provides distributed observability by collecting telemetry, request traces, and structured access logs.
Upstream Health Monitoring - Continuously monitors backend service availability to dynamically remove unhealthy endpoints from the active load balancing pool.
Kubernetes Custom Resource Definitions - Converts declarative API objects into specific routing and security rules for the underlying proxy infrastructure.
Request Tracing - Tracks requests across proxy and backend services to identify performance bottlenecks and visualize traffic paths.
Route Definitions - Defines routing rules using standard interfaces and custom resource definitions to direct incoming traffic.
Routing Delegation Systems - Allows modular routing across different namespaces and teams by including rules from other configuration objects.

nginx/kubernetes-ingress

5,039View on GitHub

The NGINX Ingress Controller is a Kubernetes-native traffic manager that handles external requests and routes them to internal services. It translates Kubernetes API objects and annotations into proxy configurations to manage incoming HTTP, TCP, and UDP traffic. The controller distinguishes itself through advanced traffic steering and security integration. It supports blue-green and canary traffic splitting, as well as content-based and regex path routing. Security is handled at the edge via a web application firewall, denial-of-service protection, and a variety of authentication methods incl

apache/apisix-ingress-controller

1,136View on GitHub

This project is a Kubernetes ingress controller that functions as an API gateway and traffic manager for containerized environments. It operates by monitoring cluster events and translating native ingress resource definitions into active routing configurations, ensuring that external traffic is directed to internal services according to declarative specifications. The controller distinguishes itself through its ability to act as a specialized gateway for artificial intelligence models, providing a secure entry point that enforces rate limits, content moderation, and prompt guardrails. It supp

emissary-ingress/emissary

4,509View on GitHub

Emissary is a Kubernetes API gateway that manages incoming external traffic and routes it to internal microservices. It utilizes an Envoy proxy as the underlying data plane to handle high-performance traffic routing and protocol translation, with a control plane that translates Kubernetes custom resources and annotations into proxy configurations. The project provides specialized support for gRPC infrastructure, including HTTP/2 routing and gRPC-Web protocol bridging for browser-based clients. It enables zero-trust security through mutual TLS encryption and delegates identity verification to

hobby-kube/guide

5,658View on GitHub

This project is a Kubernetes deployment guide and infrastructure provisioner designed for hobbyist and home lab environments. It provides a framework for setting up multi-node clusters across various cloud providers and physical or virtual nodes, acting as a self-hosted cluster orchestrator. The project focuses on security hardening and infrastructure stability through specific implementation guides. This includes a framework for network security that covers host firewalls and encrypted network overlays, as well as detailed instructions for configuring ingress routing to manage external publi

projectcontourcontour

Features