Contour

What Contour is

Contour is a free, open-source Kubernetes ingress controller that provides the control plane for the Envoy edge and service proxy. It accepts Kubernetes Ingress v1, its HTTPProxy custom resource, and Gateway API, and can update ingress configuration dynamically with minimal dropped connections. For multi-team clusters, it supports multiple ingress configuration types and can run as a Kubernetes deployment or daemonset. Administrators can delegate access to wildcard certificates. Documented security features include TLS termination, client authorization, rate limiting, JWT verification, and IP filtering. Contour and Envoy expose metrics that Prometheus can scrape, and the documentation includes guides for cert-manager, Gatekeeper, and AWS Network Load Balancer. The project is tested with Kubernetes 1.21 and later and is intended for cluster administrators and application developers. It is self-hosted and has community support through its GitHub project page. Contour is a Cloud Native Computing Foundation incubating project; its documentation also includes a threat model, security reporting process, and security fix checklist.

Who it suits

Contour suits cluster administrators and application developers working with Kubernetes ingress configuration, including multi-team clusters. It is self-hosted and offers community support through its GitHub project page.

Limits

The free plan is open source and provides community support through the GitHub project page. Contour is tested with Kubernetes clusters running version 1.21 and later.

Getting started

1. Visit the Contour project website.
2. Deploy Contour in Kubernetes as a deployment or daemonset.
3. Choose Kubernetes Ingress v1, HTTPProxy, or Gateway API for ingress configuration.
4. Use the documentation for integrations such as cert-manager, Gatekeeper, AWS Network Load Balancer, or Prometheus metrics.
5. Use the GitHub project page to ask questions or file issues.

Verdict

Contour brings several Kubernetes ingress configuration models and documented security controls under an Envoy control plane. It is a free, self-hosted option for clusters running Kubernetes 1.21 or later.