emissary

Emissary-ingress is an API gateway built on Envoy Proxy. It handles routing, TLS termination, rate limiting, authentication, and load balancing for traffic entering your Kubernetes cluster. It's the front door to your cluster that decides which request goes where.

Fully free under Apache 2.0. CNCF incubating project. You get the full gateway: path-based routing, header-based routing, gRPC support, WebSocket support, automatic TLS with Let's Encrypt, rate limiting, and OAuth2 integration. Configured via Kubernetes CRDs (Custom Resource Definitions).

The catch: Emissary's development has slowed significantly. Ambassador Labs (the company behind it) has shifted focus to Telepresence and their commercial products. The Kubernetes gateway API is becoming the standard, and newer ingress controllers (like Envoy Gateway, which is also Envoy-based) are more actively developed. If you're starting fresh, Envoy Gateway or Traefik are better bets. If you're already running Emissary, it works, but plan a migration timeline.