Emissary-ingress
Emissary-ingress is a free, open-source Kubernetes API gateway, Layer 7 load balancer, and Ingress built on Envoy.
What Emissary-ingress is
Emissary-ingress is a free, open-source Kubernetes API gateway, Layer 7 load balancer, and Ingress built on Envoy. It routes HTTP, HTTPS, proxy, TCP, TLS, gRPC, and HTTP/3 traffic. Developers can manage services through Kubernetes resources or annotations, including directing a chosen share of production traffic to a service for canary deployments. Emissary keeps its state in Kubernetes and relies on Envoy for routing and proxying, without requiring a separate database. It supports external HTTP or gRPC authentication, rate limiting, request transformation, and client certificate validation, including mutual TLS. A diagnostics service can help identify configuration problems. Emissary can also serve as an Istio edge proxy and supports Consul service discovery. It is designed for cloud-native teams whose developers operate their services, as well as developers and operators. The deployment is self-hosted on Linux; Helm is the recommended installation route, with Kubernetes YAML also documented. The project points users to CNCF Slack for community questions and GitHub issues for bug reports.
Good
- Free, open-source Kubernetes gateway.
- Routes gRPC and HTTP/3 traffic.
- Canary traffic shares are configurable through annotations.
- Includes diagnostics for configuration issues.
- Supports external authentication and rate limiting.
Watch out
- Requires a self-hosted deployment.
- Installation is oriented around Kubernetes.
- No hosted deployment option is listed.
Who it suits
It suits cloud-native developers and operators who manage services through Kubernetes, including teams using Istio or Consul. It is free to use and self-hosted.
Verdict
Emissary-ingress combines gateway, load-balancing, and ingress roles with Kubernetes-based service configuration. Its self-hosted model makes it a fit for teams already operating Kubernetes services.
Plans and prices
From Emissary-ingress's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Emissary-ingress | Free | Open-source Kubernetes API gateway |
The facts
Each one read from Emissary-ingress's own pages, with the date it was checked.
What it does
- Architecture
- Emissary persists state in Kubernetes instead of requiring a separate database, and uses Envoy for traffic routing and proxying.checked 3 Oct 2026
- Authentication and rate limiting
- Emissary can check incoming requests with an external authentication service and a third-party rate limit service before routing them.checked 3 Oct 2026
- Canary deployments
- Developers can control how much production traffic is routed to a service through annotations.checked 3 Oct 2026
- Client certificate security
- Emissary can validate client certificates using a provided CA certificate, enabling client-side mutual TLS.checked 3 Oct 2026
- Community support
- The project directs users to its CNCF Slack channel for community questions and to GitHub issues for bugs.checked 3 Oct 2026
- Consul integration
- Emissary supports Consul service discovery and can use the Ambassador Consul Connector for mTLS authentication and encryption with Consul Connect services.checked 3 Oct 2026
- Diagnostics
- Emissary includes a diagnostics service for debugging configuration issues.checked 3 Oct 2026
- For
- Emissary was designed for cloud-native organizations where developers have operational responsibility for their services, and for use by developers and operators.checked 3 Oct 2026
- Installation
- The recommended installation method is Helm; Kubernetes YAML is another documented option.checked 3 Oct 2026
- Istio integration
- Emissary can act as the edge proxy for Istio, routing external traffic to the internal service mesh.checked 3 Oct 2026
- Protocol support
- Emissary supports gRPC and HTTP/2 routing.checked 3 Oct 2026
- Self-service
- Developers can add, remove, merge, or separate services through Kubernetes resources or annotations.checked 3 Oct 2026
- What it does
- Emissary-ingress is an open-source Kubernetes-native API gateway, Layer 7 load balancer, and Kubernetes Ingress built on Envoy Proxy.checked 3 Oct 2026
Alternatives to Emissary-ingress
- 1
Amazon API Gateway
Free planAndroidiOSWebAPI8.2From $1 a month - 2
Higress
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 3
Tyk Gateway
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 4
Google Cloud Endpoints
Free planWebAPILinuxmacOS7.1$1.50 usage-based - 5
Gravitee API Gateway
Free planWebAPILinuxSelf-hosted7.1From $2,500 a month - 6
Kong Gateway
Free planWebAPILinuxSelf-hosted6.7Free plan