projectcontour/contour

Features

• Ingress Gateways - Manages external HTTP and TCP traffic routing into Kubernetes clusters using Envoy proxy instances.
• Envoy-Based Proxies - Uses a high-performance Envoy proxy to handle L7 routing, TLS termination, and load balancing for inbound network traffic.
• Ingress-Based Routing - Manages cluster traffic routing using standard interfaces and custom resource definitions.
• Proxy Orchestrators - Translates cluster resources into dynamic configurations pushed to proxy instances for real-time traffic control.
• Traffic Orchestration - Orchestrates complex traffic routing, TLS termination, and load balancing policies for containerized applications.
• Ingress Controllers - Functions as a Kubernetes ingress controller that manages external traffic routing via Envoy proxy instances.
• Kubernetes API Gateways - Acts as a cloud-native API gateway providing advanced traffic management and security for Kubernetes services.
• Load Balancing Strategies - Distributes traffic using strategies like Round Robin or Weighted Least Request to ensure efficient resource utilization.
• Virtual Host Routing - Directs incoming requests to backend services based on virtual hosts, paths, and headers.
• Circuit Breakers - Prevents cascading failures by stopping traffic to failing services based on configurable thresholds.
• API Gateway Security - Enforces security policies like JWT validation and IP filtering at the network edge to protect backend services.
• SSL/TLS Termination - Decrypts secure connections at the edge before forwarding traffic to internal services.
• Namespace Isolation Policies - Restricts which namespaces can configure virtual hosts and credentials to ensure security in shared clusters.
• Delegated - Enables multi-team environments by partitioning routing rules across namespaces for decentralized management.
• Real-Time Runtime Updates - Applies routing changes to the proxy layer in real time without requiring a restart of the underlying infrastructure.
• Request Path Rewriters - Modifies URL paths of incoming requests to ensure they match the expected format of backend services.
• Request Retries - Automatically re-attempts failed requests to backend services based on configurable conditions and limits to improve resilience.
• Ingress Provisioners - Automates the deployment and lifecycle of proxy instances by monitoring standard resources to dynamically scale traffic entry points.
• Custom Resource Mappings - Translates Kubernetes API objects into Envoy proxy configuration via a specialized translation layer.
• Dynamic Configuration Updates - Pushes routing updates to proxy instances using persistent sessions to avoid infrastructure restarts.
• High Availability Control Planes - Ensures only one active controller instance manages the configuration delivery plane to prevent conflicting state updates.
• High Availability Infrastructure - Maintains configuration delivery during node or zone failures by using leader election and load-balanced management instances.
• Leader Election - Maintains high availability of the management plane by ensuring only one instance controls configuration delivery at any time.
• Ingress Class Selectors - Assigns specific ingress resources to controller instances using class identifiers to allow coexistence.
• Kubernetes Traffic Controllers - Orchestrates complex traffic rules, TLS termination, and rate limiting through custom Kubernetes resources.
• Request Rate Limiting - Restricts request volume using local counters or external services to prevent backend service overload.
• External Load-Balancer Integrations - Connects to cloud network load balancers using the standard protocol to preserve original client IP addresses.
• Request Timeout Management - Enforces response deadlines and idle connection limits to prevent resource exhaustion during slow service responses.
• Configuration Managers - Translates Kubernetes resources into dynamic configurations for Envoy to handle L7 routing and load balancing.
• Dynamic Reverse Proxies - Distributes dynamic configuration to proxy instances using a persistent session to ensure seamless updates.
• IP Address Filtering - Restricts network access to the cluster based on allowed IP addresses or CIDR ranges.
• Multi-Protocol Support - Supports specialized communication patterns including WebSockets, gRPC, and the PROXY protocol.
• Daemon Proxy Deployments - Installs proxy instances as node-local daemons or scaled deployments to optimize performance and manage connection draining.
• TCP Proxies - Forwards raw TCP traffic to backend services to support non-HTTP protocols and specialized network applications.
• Namespace-Based Routing Delegation - Enables multiple teams to securely manage their own traffic policies within a shared cluster by delegating routing rules across namespaces.
• External Authorization Proxies - Delegates request authorization decisions to external services to support custom access control logic.
• Access Control and Authorization - Defines authorization settings and custom metadata for virtual hosts and routes to control service access.
• External Service Authorizers - Intercepts incoming requests and offloads authentication and access control decisions to specialized third-party services.
• Namespace-Based Isolation - Restricts the ability to configure virtual hosts and credentials to specific namespaces to ensure security in multi-tenant environments.
• JWT Token Validators - Verifies the authenticity and expiration of JSON Web Tokens for secure access control.
• TLS Certificate Management - Automates the provisioning and application of TLS certificates for secure ingress communication.
• HTTPS Redirection Policies - Enforces encrypted connections by redirecting insecure HTTP traffic to HTTPS.
• Configuration Streams - Streams routing updates to proxy instances over persistent connections to enable seamless changes without restarting network services.
• Routing Delegation Policies - Partitions routing rules across cluster boundaries to allow multiple teams to manage their own traffic policies securely.
• Routing Configurations - Verifies routing configuration objects during initialization to prevent runtime failures from invalid path definitions.
• Distributed Observability Systems - Provides distributed observability by collecting telemetry, request traces, and structured access logs.
• Upstream Health Monitoring - Continuously monitors backend service availability to dynamically remove unhealthy endpoints from the active load balancing pool.
• Kubernetes Custom Resource Definitions - Converts declarative API objects into specific routing and security rules for the underlying proxy infrastructure.
• Request Tracing - Tracks requests across proxy and backend services to identify performance bottlenecks and visualize traffic paths.
• Route Definitions - Defines routing rules using standard interfaces and custom resource definitions to direct incoming traffic.
• Routing Delegation Systems - Allows modular routing across different namespaces and teams by including rules from other configuration objects.
• Load Balancing and Ingress - Kubernetes ingress controller for Envoy proxy.

Star history