# projectcontour/contour

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/projectcontour-contour).**

3,934 stars · 716 forks · HTML · Apache-2.0

## Links

- GitHub: https://github.com/projectcontour/contour
- Homepage: https://projectcontour.io
- awesome-repositories: https://awesome-repositories.com/repository/projectcontour-contour.md

## Topics

`cncf` `contour` `envoy` `gateway-api` `hacktoberfest` `http-proxy` `ingress-controller` `kubernetes`

## Description

Contour is a Kubernetes ingress controller that manages external HTTP and TCP traffic by orchestrating Envoy proxy instances. It functions as a control plane that translates declarative Kubernetes API objects into dynamic proxy configurations, enabling real-time traffic management without requiring infrastructure restarts.

The system distinguishes itself through a focus on multi-tenant cluster networking and delegated configuration. By allowing routing rules to be partitioned across namespaces, it enables multiple teams to securely manage their own traffic policies within a shared cluster. It further supports complex environments by offloading authentication and access control decisions to external services and providing granular control over virtual hosts and credentials.

Beyond core routing, the project provides a comprehensive suite of traffic management and security capabilities. This includes advanced load balancing, circuit breaking, rate limiting, and TLS termination, alongside robust observability features such as distributed request tracing, structured access logging, and active backend health monitoring. The controller ensures high availability through leader election coordination and validates configuration objects during initialization to prevent runtime errors.

## Tags

### DevOps & Infrastructure

- [Ingress Gateways](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-traffic-controllers/ingress-gateways.md) — Manages external HTTP and TCP traffic routing into Kubernetes clusters using Envoy proxy instances.
- [Proxy Orchestrators](https://awesome-repositories.com/f/devops-infrastructure/centralized-control-planes/proxy-orchestrators.md) — Translates cluster resources into dynamic configurations pushed to proxy instances for real-time traffic control.
- [Traffic Orchestration](https://awesome-repositories.com/f/devops-infrastructure/cloud-native-orchestration/traffic-orchestration.md) — Orchestrates complex traffic routing, TLS termination, and load balancing policies for containerized applications.
- [Ingress Controllers](https://awesome-repositories.com/f/devops-infrastructure/ingress-controllers.md) — Functions as a Kubernetes ingress controller that manages external traffic routing via Envoy proxy instances.
- [Kubernetes API Gateways](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-api-gateways.md) — Acts as a cloud-native API gateway providing advanced traffic management and security for Kubernetes services.
- [Load Balancing Strategies](https://awesome-repositories.com/f/devops-infrastructure/traffic-load-balancers/ingress-load-balancers/backend-cluster-load-balancers/load-balancing-strategies.md) — Distributes traffic using strategies like Round Robin or Weighted Least Request to ensure efficient resource utilization. ([source](https://projectcontour.io/docs/1.33/config/api/))
- [Request Retries](https://awesome-repositories.com/f/devops-infrastructure/api-service-management/api-resilience/request-retries.md) — Automatically re-attempts failed requests to backend services based on configurable conditions and limits to improve resilience. ([source](https://projectcontour.io/docs/1.33/config/annotations/))
- [Ingress Provisioners](https://awesome-repositories.com/f/devops-infrastructure/cloud-infrastructure-deployment/managed-infrastructure-deployment/infrastructure-deployment-provisioning/declarative-infrastructure-provisioning/ingress-provisioners.md) — Automates the deployment and lifecycle of proxy instances by monitoring standard resources to dynamically scale traffic entry points. ([source](https://projectcontour.io/getting-started))
- [Custom Resource Mappings](https://awesome-repositories.com/f/devops-infrastructure/configuration-management/file-based-configuration/custom-resource-mappings.md) — Translates Kubernetes API objects into Envoy proxy configuration via a specialized translation layer.
- [Dynamic Configuration Updates](https://awesome-repositories.com/f/devops-infrastructure/dynamic-configuration-updates.md) — Pushes routing updates to proxy instances using persistent sessions to avoid infrastructure restarts.
- [High Availability Control Planes](https://awesome-repositories.com/f/devops-infrastructure/enterprise-hosting-platforms/managed-control-planes/high-availability-control-planes.md) — Ensures only one active controller instance manages the configuration delivery plane to prevent conflicting state updates.
- [High Availability Infrastructure](https://awesome-repositories.com/f/devops-infrastructure/high-availability-infrastructure.md) — Maintains configuration delivery during node or zone failures by using leader election and load-balanced management instances. ([source](https://projectcontour.io/docs/1.33/architecture/))
- [Leader Election](https://awesome-repositories.com/f/devops-infrastructure/high-availability-systems/leader-election.md) — Maintains high availability of the management plane by ensuring only one instance controls configuration delivery at any time.
- [Ingress Class Selectors](https://awesome-repositories.com/f/devops-infrastructure/ingress-controllers/ingress-class-selectors.md) — Assigns specific ingress resources to controller instances using class identifiers to allow coexistence. ([source](https://projectcontour.io/docs/1.33/config/annotations/))
- [Kubernetes Traffic Controllers](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-traffic-controllers.md) — Orchestrates complex traffic rules, TLS termination, and rate limiting through custom Kubernetes resources.
- [Request Rate Limiting](https://awesome-repositories.com/f/devops-infrastructure/request-rate-limiting.md) — Restricts request volume using local counters or external services to prevent backend service overload. ([source](https://projectcontour.io/docs/1.33/config/api/))
- [External Load-Balancer Integrations](https://awesome-repositories.com/f/devops-infrastructure/traffic-load-balancers/external-load-balancer-integrations.md) — Connects to cloud network load balancers using the standard protocol to preserve original client IP addresses. ([source](https://projectcontour.io/docs/1.25/))

### Networking & Communication

- [Envoy-Based Proxies](https://awesome-repositories.com/f/networking-communication/http-reverse-proxies/dynamic-reverse-proxies/envoy-based-proxies.md) — Uses a high-performance Envoy proxy to handle L7 routing, TLS termination, and load balancing for inbound network traffic.
- [Ingress-Based Routing](https://awesome-repositories.com/f/networking-communication/network-infrastructure-routing/network-routing-traffic-management/network-traffic-management/service-traffic-routing/ingress-based-routing.md) — Manages cluster traffic routing using standard interfaces and custom resource definitions. ([source](https://cdn.jsdelivr.net/gh/projectcontour/contour@main/README.md))
- [Virtual Host Routing](https://awesome-repositories.com/f/networking-communication/remote-storage-protocols/s3-protocol-clients/s3-bucket-exposures/virtual-host-routing.md) — Directs incoming requests to backend services based on virtual hosts, paths, and headers. ([source](https://cdn.jsdelivr.net/gh/projectcontour/contour@main/README.md))
- [Circuit Breakers](https://awesome-repositories.com/f/networking-communication/traffic-management-gateways/circuit-breakers.md) — Prevents cascading failures by stopping traffic to failing services based on configurable thresholds. ([source](https://projectcontour.io/docs/1.33/config/api/))
- [Request Timeout Management](https://awesome-repositories.com/f/networking-communication/distributed-systems-p2p/distributed-computing/communication-protocols/request-timeout-management.md) — Enforces response deadlines and idle connection limits to prevent resource exhaustion during slow service responses. ([source](https://projectcontour.io/docs/1.33/config/api/))
- [Configuration Managers](https://awesome-repositories.com/f/networking-communication/envoy-data-planes/configuration-managers.md) — Translates Kubernetes resources into dynamic configurations for Envoy to handle L7 routing and load balancing.
- [Dynamic Reverse Proxies](https://awesome-repositories.com/f/networking-communication/http-reverse-proxies/dynamic-reverse-proxies.md) — Distributes dynamic configuration to proxy instances using a persistent session to ensure seamless updates. ([source](https://projectcontour.io/docs/1.33/architecture/))
- [IP Address Filtering](https://awesome-repositories.com/f/networking-communication/ip-address-filtering.md) — Restricts network access to the cluster based on allowed IP addresses or CIDR ranges. ([source](https://projectcontour.io/docs/1.27/))
- [Multi-Protocol Support](https://awesome-repositories.com/f/networking-communication/multi-protocol-support.md) — Supports specialized communication patterns including WebSockets, gRPC, and the PROXY protocol. ([source](https://projectcontour.io/docs/1.21/))
- [Daemon Proxy Deployments](https://awesome-repositories.com/f/networking-communication/proxy-deployment-tools/sidecar-proxy-deployments/daemon-proxy-deployments.md) — Installs proxy instances as node-local daemons or scaled deployments to optimize performance and manage connection draining. ([source](https://projectcontour.io/docs/1.33/architecture/))
- [TCP Proxies](https://awesome-repositories.com/f/networking-communication/tcp-proxies.md) — Forwards raw TCP traffic to backend services to support non-HTTP protocols and specialized network applications. ([source](https://projectcontour.io/docs/1.33/config/api/))

### Security & Cryptography

- [API Gateway Security](https://awesome-repositories.com/f/security-cryptography/api-gateway-security.md) — Enforces security policies like JWT validation and IP filtering at the network edge to protect backend services.
- [SSL/TLS Termination](https://awesome-repositories.com/f/security-cryptography/cryptography/ssl-tls-certificate-management/ssl-tls-termination.md) — Decrypts secure connections at the edge before forwarding traffic to internal services. ([source](https://projectcontour.io/docs/))
- [Namespace-Based Routing Delegation](https://awesome-repositories.com/f/security-cryptography/cluster-security/multi-tenant-rbac/namespace-based-routing-delegation.md) — Enables multiple teams to securely manage their own traffic policies within a shared cluster by delegating routing rules across namespaces.
- [External Authorization Proxies](https://awesome-repositories.com/f/security-cryptography/identity-access-management/access-control/data-resource-permissions/relationship-based-access-controls/channel-based-permissions/external-authorization-proxies.md) — Delegates request authorization decisions to external services to support custom access control logic. ([source](https://projectcontour.io/docs/1.20/))
- [Access Control and Authorization](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/authorization-and-user-administration/access-control-authorization.md) — Defines authorization settings and custom metadata for virtual hosts and routes to control service access. ([source](https://projectcontour.io/docs/1.33/config/client-authorization/))
- [External Service Authorizers](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/authorization-and-user-administration/access-control-authorization/authorization-services/external-service-authorizers.md) — Intercepts incoming requests and offloads authentication and access control decisions to specialized third-party services.
- [Namespace-Based Isolation](https://awesome-repositories.com/f/security-cryptography/multi-tenant-isolation/namespace-based-isolation.md) — Restricts the ability to configure virtual hosts and credentials to specific namespaces to ensure security in multi-tenant environments.
- [JWT Token Validators](https://awesome-repositories.com/f/security-cryptography/security/policies/token-validation/bearer-token-validators/jwt-token-validators.md) — Verifies the authenticity and expiration of JSON Web Tokens for secure access control. ([source](https://projectcontour.io/docs/1.33/config/api/))
- [TLS Certificate Management](https://awesome-repositories.com/f/security-cryptography/tls-certificate-management.md) — Automates the provisioning and application of TLS certificates for secure ingress communication. ([source](https://projectcontour.io/docs))
- [HTTPS Redirection Policies](https://awesome-repositories.com/f/security-cryptography/tls-traffic-encryption/https-redirection-policies.md) — Enforces encrypted connections by redirecting insecure HTTP traffic to HTTPS. ([source](https://projectcontour.io/docs/1.33/config/annotations/))

### Software Engineering & Architecture

- [Namespace Isolation Policies](https://awesome-repositories.com/f/software-engineering-architecture/multi-tenant-isolation-policies/configuration-namespace-isolation/namespace-isolation-policies.md) — Restricts which namespaces can configure virtual hosts and credentials to ensure security in shared clusters. ([source](https://projectcontour.io/docs/main/config/fundamentals/))
- [Delegated](https://awesome-repositories.com/f/software-engineering-architecture/routing-configurations/delegated.md) — Enables multi-team environments by partitioning routing rules across namespaces for decentralized management. ([source](https://projectcontour.io/docs/main/config/fundamentals/))
- [Configuration Streams](https://awesome-repositories.com/f/software-engineering-architecture/event-driven-architectures/configuration-streams.md) — Streams routing updates to proxy instances over persistent connections to enable seamless changes without restarting network services.
- [Routing Delegation Policies](https://awesome-repositories.com/f/software-engineering-architecture/naming-conventions/reserved-names/access-restrictions/service-account-permissions/namespace-access-controls/namespace-scoped-operations/policy-to-namespace-mappings/routing-delegation-policies.md) — Partitions routing rules across cluster boundaries to allow multiple teams to manage their own traffic policies securely.
- [Routing Configurations](https://awesome-repositories.com/f/software-engineering-architecture/routing-configurations.md) — Verifies routing configuration objects during initialization to prevent runtime failures from invalid path definitions. ([source](https://projectcontour.io/docs/main/config/fundamentals/))

### Development Tools & Productivity

- [Real-Time Runtime Updates](https://awesome-repositories.com/f/development-tools-productivity/configuration-updates/real-time-runtime-updates.md) — Applies routing changes to the proxy layer in real time without requiring a restart of the underlying infrastructure. ([source](https://cdn.jsdelivr.net/gh/projectcontour/contour@main/README.md))
- [Request Path Rewriters](https://awesome-repositories.com/f/development-tools-productivity/path-managers/path-modifiers/request-path-rewriters.md) — Modifies URL paths of incoming requests to ensure they match the expected format of backend services. ([source](https://projectcontour.io/docs/1.33/config/api/))

### System Administration & Monitoring

- [Distributed Observability Systems](https://awesome-repositories.com/f/system-administration-monitoring/distributed-observability-systems.md) — Provides distributed observability by collecting telemetry, request traces, and structured access logs.
- [Upstream Health Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/health-monitoring/instance-health-monitors/microservices-health-monitoring/upstream-health-monitoring.md) — Continuously monitors backend service availability to dynamically remove unhealthy endpoints from the active load balancing pool.
- [Kubernetes Custom Resource Definitions](https://awesome-repositories.com/f/system-administration-monitoring/monitoring-and-observability/rule-based-alerting-engines/alerting-rule-validators/declarative-rule-management/kubernetes-custom-resource-definitions.md) — Converts declarative API objects into specific routing and security rules for the underlying proxy infrastructure.
- [Request Tracing](https://awesome-repositories.com/f/system-administration-monitoring/request-tracing.md) — Tracks requests across proxy and backend services to identify performance bottlenecks and visualize traffic paths. ([source](https://projectcontour.io/docs/1.29/))

### User Interface & Experience

- [Route Definitions](https://awesome-repositories.com/f/user-interface-experience/view-presentation-styling/controller-presentation/resource-presenter-controllers/route-definitions.md) — Defines routing rules using standard interfaces and custom resource definitions to direct incoming traffic. ([source](https://cdn.jsdelivr.net/gh/projectcontour/contour@main/README.md))

### Web Development

- [Routing Delegation Systems](https://awesome-repositories.com/f/web-development/backend-development/web-frameworks/routing-request-handling/modular-routing-systems/routing-delegation-systems.md) — Allows modular routing across different namespaces and teams by including rules from other configuration objects. ([source](https://projectcontour.io/docs/main/config/fundamentals/))

### Part of an Awesome List

- [Load Balancing and Ingress](https://awesome-repositories.com/f/awesome-lists/devtools/load-balancing-and-ingress.md) — Kubernetes ingress controller for Envoy proxy.