I'm evaluating API Gateway controllers for applications that require mutual TLS. I'm especially interested in setups using true TLS passthrough, along with any practical experience using controllers such as Envoy Gateway, Traefik, or similar options. Which controller are you running, and have you encountered any configuration challenges, compatibility issues, or production gotchas? Recommendations and lessons learned are welcome.
6 Answers
Envoy Gateway supports both terminating HTTPRoutes and non-terminating TLSRoutes on the same listener, but you may need a recent release for that combination. It’s worth checking the version-specific behavior before deploying.
Envoy Gateway has worked well for us. Our applications are fairly simple, and TLS passthrough using TLSRoute has been straightforward with no major problems so far.
One setup that works well for us is a load balancer targeting dedicated ingress nodes, with Traefik running on those nodes. We terminate TLS at the gateway and use middleware for things like rate limiting and IP allowlists. A separate node pool for ingress makes the deployment easier to manage than running everything across the general-purpose nodes.
Be clear about what you mean by mTLS passthrough. With genuine TLS passthrough, the gateway does not terminate TLS or validate client certificates; the application has to perform the mTLS verification. If you want the gateway to validate the client certificate, TLS must terminate at the gateway and then be re-established to the backend. Envoy Gateway can support either model, but they have different configuration and security implications.
That distinction is exactly what I need. In this case, I’m intentionally looking for passthrough so the application remains responsible for the client-certificate checks.
Both the open-source Traefik and Envoy options are worth considering. If you’re looking at commercial products, Anypoint Flex Gateway is another possibility.
Kgateway has been working fine for us, although the initial installation and configuration took some effort. It’s worth comparing the available controllers and choosing based on the features and benchmarks that matter for your environment.
That sounds promising. Our applications aren’t especially complex either, so Envoy Gateway is currently the direction I’m leaning.