BFE Ingress Controller

Overview

BFE Ingress Controller is an open-source, self-hosted Layer 7 load balancer for teams managing application traffic in their own environments. It is a strong fit for operators who need content-based routing, traffic controls across zones, and built-in visibility into service behavior. Its wide protocol coverage and operational features make it a capable infrastructure choice, though adoption means taking responsibility for installation and configuration.

Key features

BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI. That range covers web applications and service traffic, while the absence of current HTTP/3 support rules it out for deployments that require that protocol now.

Its domain-specific language defines content-based routing, and canary routing is supported. Global and distributed load balancing, zone-aware distribution, zone-level failure resilience, and overload protection give operators meaningful control over traffic placement and pressure handling. Those controls suit complex, multi-zone deployments, but teams should expect to manage routing policy themselves.

A built-in plugin framework can add traffic management, security, and observability capabilities. BFE also provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. Integrations with mainstream Layer 4 load balancers and projects such as Kubernetes, Prometheus, Jaeger, and Fluentd help it fit into an existing infrastructure stack.

Multi-tenancy keeps each tenant’s configuration isolated and hidden from other tenants. BFE is written in Go, which the project describes as memory-safe, and is licensed under Apache 2.0 as a CNCF sandbox project. Installation paths include source, binaries, Go, Snap, and Docker, giving operators several ways to deploy it. Questions can go through GitHub issues, which the project says it answers on working days, as well as GitHub Discussions and CNCF Slack. Suspected security issues should be reported privately to the project.

Pricing

BFE is free under its Open source plan at no cost, with the Apache 2.0 license. No trial is offered, and no plan limits are stated. This makes it suitable for teams able to operate their own ingress layer without a paid subscription; the trade-off is that the self-hosted software does not remove the work of deployment, configuration, and ongoing operations.

Platforms

BFE supports API, Linux, macOS, Windows, and self-hosted deployments. Its installation options include source, binary, Go, Snap, and Docker paths, providing flexibility for teams deploying in their own environments.

Who it's for

BFE is best for infrastructure teams that need an open-source ingress and load-balancing layer with content-based and canary routing, multi-zone resilience, tenant isolation, and observability. It is less suitable for teams seeking a managed service or deployments that require HTTP/3 today.

Pros and cons

• Pros: Broad protocol support, including HTTP/2, gRPC, WebSocket, and FastCGI, suits mixed application and service traffic.
• Pros: Global and zone-aware balancing, failure resilience, and overload protection provide controls for distributed deployments.
• Pros: Metrics, logs, distributed tracing, and a plugin framework support operational visibility and extension.
• Pros: Apache 2.0 licensing and no stated plan limits make it a flexible free option for self-hosting.
• Cons: HTTP/3 is planned, not supported, leaving current HTTP/3 requirements unmet.
• Cons: The self-hosted model and domain-specific routing rules call for operators prepared to deploy and manage the system themselves.

Alternatives

For a broader comparison of products in this category, see Kubernetes Ingress Controllers.

• ngrok suits readers who want a freemium option with a free plan that includes up to three online endpoints and 1 GB of data transfer.
• Kusk Gateway is another free, open-source gateway, offered under the MIT License.
• Traefik Proxy is a free option that combines ingress control, reverse proxying, load balancing, and service auto-discovery.
• agentgateway is a free open-source gateway deployable as a binary, Docker container, or Kubernetes workload.
• HAProxy Ingress is a free choice for Kubernetes clusters; its v0.16 release requires Kubernetes 1.21 or newer.
• Airlock Microgateway offers a free Community Edition for small environments or local development, with enforced throughput and six-month license validity.
• Contour is a free open-source Kubernetes ingress controller with community support.
• Envoy Gateway is another free, open-source project for self-hosted API gateway use.

Verdict

Choose BFE if your team wants a free, Apache 2.0-licensed ingress layer that combines extensive protocol support with granular routing, resilience controls, tenant isolation, and observability. Its main reason to look elsewhere is straightforward: HTTP/3 is not yet supported, and operating a self-hosted controller requires ownership of its deployment and configuration.