heystack

Kubernetes Ingress Controllers

How do you choose the *right* Kubernetes Ingress controller when: - Not all Ingress controllers support UDP - Only Kong has a free LDAP integration - Nginx Ingress and HAProxy are the only two ingress without CRDs Here is a comparison.

From the heystacks.com archiveUpdated 663 views
Open original
View as text
Product/ProjectIngress NginxKongApache APISIXAzure App Gateway IngressNginx+HAProxy TechHAProxy (jcmoraisjr)VoyagerIstio IngressContour

1. General info

Based onnginxnginxnginxnginx + Azure App Gatewaynginxhaproxyhaproxyhaproxyenvoyenvoyenvoy
Documentationhttps://kubernetes.github.io/ingress-nginx/https://docs.konghq.com/kubernetes-ingress-controller/latest/https://github.com/apache/apisix-ingress-controller/blob/master/README.mdhttps://azure.github.io/application-gateway-kubernetes-ingress/https://docs.nginx.com/nginx-ingress-controller/https://github.com/haproxytech/kubernetes-ingresshttps://haproxy-ingress.github.io/docs/https://voyagermesh.com/docs/v12.0.0/welcome/https://istio.io/latest/docs/https://projectcontour.io/docs/main/https://www.getambassador.io/products/api-gateway/
2. Protocolsreference
HTTP/HTTPS✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
HTTP2Comparison of Kubernetes Ingress controllers✔️✔️✔️Partial✔️✔️✔️✔️✔️✔️✔️
HTTP3 (QUIC)Preview✖︎✖︎✖︎Preview✖︎✖︎✖︎Preview✖︎✔️
gRPC✔️✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
TCPPartial✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
TCP+TLS✖︎✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
UDPPartial✔️✔️✖︎✔️✖︎✖︎✖︎✖︎✖︎✖︎
Websockets✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Proxy Protocol✔️✔️✔️Needs help✔️✔️✔️✔️✔️✔️✔️
3. ClientsLeave a comment or drop us a line at research@learnk8s.io
Rate limiting (L4)✔️✔️Needs helpPartial✔️✔️✔️✔️✔️✖︎✔️
Rate limiting (L7)✔️✔️✔️Partial✔️✔️✔️✔️✔️✔️✔️
WAFLicense:✔️✔️Partial✔️✔️✔️✔️✖︎✖︎✖︎✔️
TimeoutsApache 2.0✔️✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
Safe-list/Block-listLast updated:✔️✔️✔️✖︎✔️✔️✔️Partial✔️✖︎✔️
AuthenticationAugust 21, 2023✔️✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
Authorisation✖︎✔️✔️✖︎✔️✔️Partial✖︎✔️✔️✔️
4. Traffic routingFind more research at:
Hosthttps://learnk8s.io/research✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Path✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Headers✔️Supported in Free version✔️✔️✔️✔️✔️✔️✔️✖︎✔️✔️✔️
Querystring✔️Supported in Enterprise version✔️✔️✔️✔️✔️✔️✔️✖︎✔️✖︎✔️
Method✖︎Not supported✔️✔️✔️✔️✔️✔️✔️✖︎✔️✔️✔️
ClientIPPartialPartially supported✔️✔️✔️✔️✔️✔️✔️✖︎✔️✖︎✔️
NotesNeeds helpNot sure if it is supported
NotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotes

5. Upstream probes/resiliency

Healthchecks✖︎✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Retries✔️✔️✔️✔️✔️✔️✔️✖︎✔️✔️✔️
Circuit Breaker✖︎✔️✔️✖︎✔️✔️✖︎✖︎✔️✖︎✔️

6.Load balancer strategies

Round robin✔️✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
Sticky sessions✔️✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
Least connections✖︎✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
Ring hash✔️✔️✔️✖︎✔️✖︎✖︎✖︎✔️✔️✔️
Maglev✖︎✖︎✖︎✖︎✖︎✖︎✖︎✖︎✔️✖︎✔️
Exponential-Weighted-Moving-Average✔️✖︎✔️✖︎✖︎✖︎✖︎✖︎✖︎✖︎✖︎
Custom load balancing✖︎✖︎✔️✖︎Partial✖︎✖︎✖︎✖︎✖︎✖︎
Power of two random choicesNeeds helpNeeds helpNeeds helpNeeds help✔️✖︎✖︎Needs helpNeeds helpNeeds helpNeeds help
Global load balancingNeeds helpNeeds help✔️Needs help✔️✖︎Needs helpNeeds helpNeeds helpNeeds helpNeeds help
External load balancingNeeds helpNeeds helpNeeds helpNeeds help✔️✔️Needs helpNeeds helpNeeds helpNeeds helpNeeds help

Notes

NotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotesNotes

7. Authentication

Basic auth✔️✔️✔️✖︎✔️✔️✔️✔️✔️✔️✔️
External Auth✔️✔️✔️✖︎✔️✖︎✔️✔️✔️✔️✔️
Client certificate - mTLS✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
OAuth✔️✔️✔️✖︎✔️✔️✔️✔️✔️✖︎✔️
OpenID✖︎✔️✔️✖︎✔️✔️✖︎✖︎✔️✖︎✔️
JWT✖︎✔️✔️✖︎✔️✖︎✖︎✖︎✔️✖︎✔️
LDAP✖︎✔️✔️✖︎✔️✖︎✖︎✖︎✖︎✖︎✖︎
HMAC✖︎✔️✔️✖︎✔️✖︎✖︎✖︎✖︎✖︎✖︎
SAMLNeeds help✔️✔️Needs help✔️✖︎Needs helpNeeds helpNeeds helpNeeds helpNeeds help

8. Observability

Logging✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Metrics✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Tracing✔️✔️✔️✔️✔️✔️✖︎Needs help✔️✔️✔️

9. Kubernetes Integration

CRD✖︎✔️✔️✔️✔️✔️✖︎✔️✔️✔️✔️
ScopeClusterwide and namespaceClusterwide and namespacenamespaceClusterwide and namespaceClusterwide and namespaceClusterwide and namespaceClusterwide and namespaceClusterwide and namespaceClusterwide and namespaceClusterwide and namespaceClusterwide and namespace
Support for the Gateway API (Ingress v2) current v1alpha2✖︎✔️Preview✖︎PreviewPreview✔️Needs helpPreview✔️Preview
Integrates with service meshes✔️✔️✔️✖︎✔️✔️✔️Needs help✔️✖︎���️

10. Traffic shaping

Canary✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Session Affinity✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Traffic Mirroring✔️Needs help✔️✔️✔️✔️✔️✖︎✔️✔️✔️

11. Interface

Dashboard✖︎✔️✔️✔️✔️✖︎✖︎✖︎✔️✖︎✔️
Billing and reporting✖︎✔️✔️✔️✖︎✔️✖︎✖︎✖︎✖︎✔️
Developer portal✖︎✔️✔️✔️✔️✔️✖︎✖︎✔️✖︎✔️

12. Other

Hot reloading✔️✔️✔️Needs help✔️✔️✔️Needs help✔️✔️✔️
LetsEncrypt Integration✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️✔️
Transparent update of certificatesNeeds helpNeeds help✔️Needs helpNeeds help✔️Needs helpNeeds helpNeeds helpNeeds helpNeeds help
Wildcard certificate support✔️✔️✔️✔️✔️✔️Needs helpNeeds helpNeeds helpNeeds help✔️
State sharingNeeds helpNeeds helpNeeds helpNeeds help✔️✔️Needs helpNeeds helpNeeds helpNeeds helpNeeds help
programmingKubernetesdevopstechnology

Read source · Agent API · Licensing · Report content

Discussion 0

0/5,000

No discussion yet. Start it — no sign-up needed.