Envoy Gateway
Envoy Gateway is an open-source application gateway that manages Envoy Proxy in standalone or Kubernetes-based deployments.
What Envoy Gateway is
Envoy Gateway is an open-source application gateway that manages Envoy Proxy in standalone or Kubernetes-based deployments. It provisions and configures proxies with Kubernetes Gateway API resources, extending those resources to expose Envoy features. Traffic management includes rate limiting, retries, circuit breaking, timeouts, and failover. Security options include mTLS, JWT-based access control, OIDC integration, and API-key authorization; listed authentication methods also include Basic Auth and external authorization. Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during the TLS handshake. Observability features include metrics, access logging, and distributed tracing. Installation options include Helm, Argo CD, Flux CD, or Kubernetes YAML. A Kubernetes cluster is required for the quickstart. The project is free at no cost under the Apache-2.0 license. It supports HTTP, HTTPS, gRPC, TLS, TCP, and UDP. Its documentation warns that the latest release includes recent main-branch commits and might not be stable.
Good
- Free and released under Apache-2.0
- Supports Gateway API resources
- Includes traffic controls and security options
- Provides metrics, access logs, and tracing
- Supports HTTP, HTTPS, gRPC, TLS, TCP, and UDP
Watch out
- Quickstart requires a Kubernetes cluster
- Latest release might not be stable
- Self-hosted deployment
Who it suits
Envoy Gateway suits teams deploying a self-hosted application gateway with standalone or Kubernetes-based modes. The quickstart requires a Kubernetes cluster, and installation options include several deployment tools and Kubernetes YAML.
Verdict
Envoy Gateway offers gateway controls, security features, and observability in a free open-source project. Readers should note the Kubernetes quickstart requirement and the release stability caveat.
Plans and prices
From Envoy Gateway's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Envoy Gateway | Free | Open-source project · standalone or Kubernetes-based application gateway |
The facts
Each one read from Envoy Gateway's own pages, with the date it was checked.
What it does
- Community support
- The project directs users to Envoy Slack, GitHub discussions and issues, and community meetings.checked 4 Oct 2026
- Deployment
- The project can manage Envoy Proxy as a standalone or Kubernetes-based application gateway.checked 4 Oct 2026
- Enterprise support
- The project site lists third-party enterprise support and consulting providers, including Tetrate Enterprise Gateway for Envoy.checked 4 Oct 2026
- Extensibility
- The control plane is designed to support custom policies, specialized solutions, and extensions.checked 4 Oct 2026
- Gateway API
- Envoy Gateway implements the Kubernetes Gateway API and extends it to expose Envoy features through Gateway API resources.checked 4 Oct 2026
- Installation
- The documentation provides installation paths using Helm, Argo CD, Flux CD, and Kubernetes YAML.checked 4 Oct 2026
- Integrations
- The project lists integrations and ecosystem projects including Envoy AI Gateway, Kuadrant, Knative, KServe, and KEDA.checked 4 Oct 2026
- Observability
- The project lists metrics, access logging, and distributed tracing as observability features.checked 4 Oct 2026
- Open source
- The project describes Envoy Gateway as open source and its GitHub repository lists the Apache-2.0 license.checked 4 Oct 2026
- Prerequisite
- The quickstart requires a Kubernetes cluster.checked 4 Oct 2026
- Purpose
- Envoy Gateway manages Envoy Proxy as a standalone or Kubernetes-based application gateway, using Gateway API resources to provision and configure proxies.checked 4 Oct 2026
- Release caveat
- The documentation says the latest release contains recent main-branch commits and might not be stable.checked 4 Oct 2026
- Security
- Its security controls include mTLS, JWT-based access control, OIDC integration, and API-key authorization.checked 4 Oct 2026
- Security features
- Its security controls include mTLS, JWT-based access control, OIDC integration, and API-key authorization.checked 4 Oct 2026
- TLS
- Envoy Gateway supports TLS termination and can attach an OCSP response from a Gateway certificate Secret during the TLS handshake.checked 4 Oct 2026
- Traffic management
- The project lists rate limiting, retries, circuit breaking, timeouts, and failover among its traffic management capabilities.checked 4 Oct 2026
Alternatives to Envoy Gateway
- 1
ngrok
Free planWebAPILinuxmacOS7.8From $10 a month - 2
Higress
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 3
Traefik Proxy
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 4
agentgateway
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 5
Kusk Gateway
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 6
BFE Ingress Controller
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan