Envoy Gateway vs Cilium vs Traefik: Kubernetes traffic routing

When someone visits your application's hostname, something must accept the connection and send it to the right Kubernetes Service. An Ingress controller or gateway performs that job, often handling HTTPS certificates and routing by hostname or URL path as well.

Ingress and Gateway API describe routing rules in Kubernetes; a controller implements those rules. Gateway API gives shared infrastructure and application routes separate resources. Installing its definitions alone does not install a working proxy. You still need an implementation such as Envoy Gateway, Cilium's Gateway support, Traefik or a provider-managed gateway.

Envoy Gateway manages an Envoy proxy for gateway traffic. Cilium adds gateway capabilities to its broader Kubernetes networking system. Traefik is a reverse proxy with Kubernetes routing integrations. Compare Envoy Gateway versus Traefik when selecting a dedicated gateway, and assess Cilium when it already supplies your cluster network. A managed gateway can suit a team that prefers the cloud provider to handle more of the infrastructure.

The community ingress-nginx controller retired in March 2026. That does not retire the Ingress API or F5 NGINX Ingress Controller, which is a separate project. Identify the controller you actually run before deciding to migrate.

Choose a gateway for the traffic your application uses

If your platform team already operates Cilium, assess its Gateway integration within that supported platform. If you want an independently operated Envoy-based gateway, evaluate Envoy Gateway. Traefik is another candidate for teams needing a path across Ingress and Gateway resources. Cloud-managed gateways can reduce controller operations but introduce provider-specific features and service limits. None is a universal winner.

1. List protocols and traffic patterns: HTTP, gRPC, WebSocket, TCP, large uploads, streaming responses and long-lived connections.
2. Inventory behavior beyond routing: authentication, source-IP handling, redirects, rewrites, rate limits, certificate ownership and access logs.
3. Check the implementation's conformance report for the exact release. Passing core conformance does not establish support for every extension you use.
4. Choose who owns gateway infrastructure and who may attach routes. Test cross-namespace permissions and certificate access explicitly.

Compare behavior, not checkbox totals

A routing rule that looks equivalent can change path matching, forwarded headers or backend TLS. A successful health check proves little about authentication and request transformations. Use recorded synthetic requests against both controllers, then compare status, headers, routing and latency under your workload. Keep sensitive production payloads out of the fixture.

Adoption and exit cost

Record cloud load-balancer costs, policy resources, custom annotations, extension APIs and troubleshooting ownership. A portable API reduces some coupling; it does not erase implementation differences. Keep the old data plane available during a staged cutover and agree on error-rate and authentication-failure thresholds before moving traffic.

This comparison is a decision framework based on upstream documentation, not a benchmark. The historical comparison remains useful for understanding old links; its product generations and feature claims should be read in their original period. Continue with the migration planning guide.

Build a request-level comparison

Use a small test application that can report the received method, path and selected headers. Give each test a hostname, request, expected backend, expected response and security expectation. This makes a controller decision reviewable without pretending that one product's annotation has a direct equivalent in every other implementation.

• Routing: check exact paths, prefixes, trailing slashes, overlapping hostnames, unknown hosts and an unavailable backend. Record which rule wins when several might match.
• Identity: test authenticated, expired, missing and malformed credentials. Check whether an unauthorized request reaches the backend and whether an authentication outage fails as intended.
• Transport: include long requests, WebSockets or gRPC where used, client disconnects, TLS termination and backend TLS. Match timeouts across the client, gateway and application.
• Request transformation: verify rewrites, redirects, preserved query strings, forwarded scheme and client address. Confirm the application trusts only the intended proxy path.
• Operations: test certificate replacement, gateway restart, rolling update and endpoint withdrawal. Confirm that a responder can identify a rejected route from status and logs.

Understand what the API standardizes

Gateway API separates infrastructure and application routing responsibilities. That separation is useful when a platform team controls shared gateways while application teams own routes. It still requires an agreed permission model. Decide which namespaces may attach to a listener and which cross-namespace references are allowed. An overly broad attachment policy can let an application claim traffic it should not receive.

Read the selected implementation's conformance and feature documentation for the release you intend to install. Distinguish a standard feature, an optional extended feature and a vendor-specific policy. Put every extension in the platform inventory so the next migration starts with a clear list of dependencies. An upstream example on a development branch is not a compatibility guarantee for an older installed release.

Make the shortlist small enough to test

For an existing Cilium installation with a supported configuration, evaluate whether its gateway capability meets the request matrix before adding another networking control plane. For a team that wants a dedicated gateway lifecycle, assess Envoy Gateway or another maintained implementation independently. For a cloud-managed option, check the provider's supported route features, provisioning delay, quotas and observability access alongside the recurring price.

Traefik's suitability depends on the particular APIs and middleware a workload needs. F5 NGINX Ingress Controller is a separate project with its own documentation and support model. Neither name similarity nor use of the NGINX proxy proves equivalence to community ingress-nginx. Use the controller image, repository and IngressClass from the actual installation to identify what is running.

Decide from evidence

Keep a short decision record: required behaviors, results for each candidate, unsupported cases, operating owner and rollback path. Prefer a target that passes the required cases with understandable operations. Do not reward optional features that the platform has no plan to run or support. Recheck the record when a major controller upgrade changes the behavior you rely on.