BFE Ingress Controller

BFE Ingress Controller is an open-source Layer 7 load balancer for teams running their own ingress and traffic-routing infrastructure. It pairs content-based rules with tenant isolation, resilience controls, and observability. Its strongest fit is an operator who wants those capabilities in a self-hosted system; HTTP/3 support remains a gap for workloads that need it today.

Overview

Derived from Baidu’s proprietary Baidu Front End, BFE brings ingress routing and load balancing into an Apache 2.0-licensed project. Its self-hosted deployment model gives teams control over where the service runs, while its CNCF sandbox status and integrations with Kubernetes and monitoring tools make it relevant to cloud-native environments. This is infrastructure to operate yourself, rather than a managed gateway service.

Key features

BFE handles HTTP, HTTPS, SPDY, HTTP/2, WebSocket, TLS, gRPC, and FastCGI. That breadth suits teams with a mix of web and service traffic. HTTP/3 is planned, so deployments that require it now will need a different choice.

Routing rules are written in a domain-specific language and can use content-based conditions; canary routing is supported. Global and distributed balancing, zone-aware routing, zone-level failure resilience, and overload protection give operators several ways to direct traffic and manage pressure across zones. These are useful controls for distributed deployments, though they place rule definition and operation in the team’s hands.

A built-in plugin framework supports extensions for traffic management, security, and observability. BFE also provides subsystem metrics, troubleshooting and analysis logs, and distributed tracing. Integration with mainstream Layer 4 load balancers and projects including Kubernetes, Prometheus, Jaeger, and Fluentd can fit it into an existing infrastructure stack.

Each tenant’s configuration is isolated and hidden from other tenants, a practical safeguard for shared environments. The project is written in Go, which it describes as memory-safe, and says this makes BFE immune to buffer overflow vulnerabilities. Installation paths include source, binaries, Go, Snap, and Docker. For support, users can turn to GitHub issues, GitHub Discussions, and a CNCF Slack channel; suspected security issues should be reported privately to [email protected].

Pricing

BFE’s Open source plan costs nothing and is licensed under Apache 2.0. It is the fit for teams able to deploy and operate the controller themselves. No trial is offered, and the plan has no stated limits; the price does not change the self-hosted operating model.

Platforms

BFE lists API, Linux, macOS, self-hosted, and Windows support. Its deployment model is self-hosted, and its ingress API model is ingress. Installation options include source, binary, Go, Snap, and Docker.

Who it's for

BFE suits infrastructure teams that need content-based ingress rules, canary routing, and traffic distribution across zones, especially when tenant configuration isolation and operational visibility matter. It is also a reasonable candidate for teams already working with Kubernetes, Prometheus, Jaeger, Fluentd, or Layer 4 load balancers. Teams that need HTTP/3 now or want a service that is not self-hosted should look elsewhere.

Pros and cons

Pros

• Apache 2.0 licensing and a free plan make BFE accessible to teams that can run it themselves.
• Global and distributed balancing, zone failure resilience, overload protection, and canary routing cover several traffic-management needs.
• Tenant-isolated configuration, metrics, logs, and tracing support shared operations and troubleshooting.
• Multiple installation paths and integrations with Kubernetes and observability projects help it fit varied self-managed environments.

Cons

• HTTP/3 is planned rather than supported, limiting its fit for teams that require that protocol today.
• Self-hosting means the team must take responsibility for running and maintaining the controller.
• Routing depends on a domain-specific language, so teams need to be prepared to define and manage rules directly.

Alternatives

Consider Kubernetes Ingress Controllers to compare options across the category. Choose ngrok if its free plan’s included usage, up to three online endpoints, and up to 1GB data transfer suit your needs. Kusk Gateway is another free, open-source option under the MIT License.

Traefik Proxy may suit teams looking for a free open-source ingress controller, reverse proxy, and load balancer with service auto-discovery. agentgateway offers an open-source gateway with binary, Docker, or Kubernetes deployment. HAProxy Ingress requires a Kubernetes cluster, and version 0.16 requires Kubernetes 1.21 or newer.

Higress offers a free self-hosted Community Edition with community support and documentation, with users responsible for stability and performance. NGINX Gateway Fabric is a free open-source Kubernetes project whose Gateway API support varies by resource. Airlock Microgateway has a free Community Edition for small environments or local development, with enforced throughput and six-month license validity.

Verdict

Choose BFE if your team can operate a self-hosted controller and wants content-based routing, multi-zone balancing controls, tenant isolation, and built-in observability without a license cost. Its main limitation is the absence of HTTP/3 support today, which makes it a poor fit when that protocol is a requirement.