Freedom251 › API Gateway Software
Emissary-ingress
What Emissary-ingress is
Emissary-ingress is a free, open-source API gateway and Kubernetes Ingress for cloud-native services. Built on Envoy, it also functions as a Layer 7 load balancer. It routes HTTP, HTTPS, proxy, TCP, TLS, gRPC and HTTP/3 traffic, with gRPC and HTTP/2 routing called out among its protocol capabilities. Developers can add, remove, combine or separate services through Kubernetes resources or annotations, and use annotations to direct a chosen share of production traffic for canary deployments. Emissary keeps state in Kubernetes rather than a separate database and relies on Envoy for routing and proxying. It can check requests with external authentication and rate-limit services, transform requests and validate client certificates, including for mutual TLS. A diagnostics service helps investigate configuration issues. Emissary can serve as an Istio edge proxy and supports Consul service discovery. It is self-hosted on Linux; Helm is the recommended installation method, with Kubernetes YAML also documented.
Who it suits
Emissary-ingress suits developers and operators in cloud-native organizations where developers are responsible for operating their services. It is designed for teams managing services through Kubernetes.
What it does well
- Free and open-source.
- Service changes can be managed through Kubernetes resources or annotations.
- Supports canary traffic control.
- Includes diagnostics for configuration issues.
- Can act as an Istio edge proxy.
What to know first
- Requires a self-hosted deployment.
- Designed for Kubernetes environments.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Emissary-ingress | Open-source Kubernetes API gateway | Free |
As emissary-ingress.dev lists them, read 3 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Emissary-ingress website.
- Use the recommended Helm installation method, or choose the documented Kubernetes YAML option.
- Configure services through Kubernetes resources or annotations.
- Use annotations to set the production traffic share for a canary deployment.
Verdict
Emissary-ingress combines Kubernetes service management with Envoy-based routing, authentication options and diagnostics. Its self-hosted Kubernetes deployment is a key consideration for teams evaluating it.
Questions
Is Emissary-ingress free?
Yes. Its free plan is priced at $0, and it is open source.
Where does Emissary-ingress run?
It is self-hosted, and Linux is the listed platform.
What protocols does it support?
Supported protocols include HTTP, HTTPS, HTTPPROXY, HTTPSPROXY, TCP, TLS, gRPC, and HTTP/3.
How can I install it?
Helm is the recommended installation method. Kubernetes YAML is also documented.
What authentication options does it support?
It supports basic authentication, external HTTP or gRPC authentication services, client certificate validation, and mutual TLS.
Does it integrate with Istio or Consul?
It can act as Istio's edge proxy and supports Consul service discovery. With the Ambassador Consul Connector, it can use mTLS authentication and encryption with Consul Connect services.
Facts from Emissary-ingress's own pages
- Architecture
- Emissary persists state in Kubernetes instead of requiring a separate database, and uses Envoy for traffic routing and proxying. · emissary-ingress.dev, 3 Oct 2026
- Authentication and rate limiting
- Emissary can check incoming requests with an external authentication service and a third-party rate limit service before routing them. · emissary-ingress.dev, 3 Oct 2026
- Canary deployments
- Developers can control how much production traffic is routed to a service through annotations. · emissary-ingress.dev, 3 Oct 2026
- Client certificate security
- Emissary can validate client certificates using a provided CA certificate, enabling client-side mutual TLS. · emissary-ingress.dev, 3 Oct 2026
- Community support
- The project directs users to its CNCF Slack channel for community questions and to GitHub issues for bugs. · emissary-ingress.dev, 3 Oct 2026
- Consul integration
- Emissary supports Consul service discovery and can use the Ambassador Consul Connector for mTLS authentication and encryption with Consul Connect services. · emissary-ingress.dev, 3 Oct 2026
- Diagnostics
- Emissary includes a diagnostics service for debugging configuration issues. · emissary-ingress.dev, 3 Oct 2026
- For
- Emissary was designed for cloud-native organizations where developers have operational responsibility for their services, and for use by developers and operators. · emissary-ingress.dev, 3 Oct 2026
- Installation
- The recommended installation method is Helm; Kubernetes YAML is another documented option. · emissary-ingress.dev, 3 Oct 2026
- Istio integration
- Emissary can act as the edge proxy for Istio, routing external traffic to the internal service mesh. · emissary-ingress.dev, 3 Oct 2026
- Protocol support
- Emissary supports gRPC and HTTP/2 routing. · emissary-ingress.dev, 3 Oct 2026
- Self-service
- Developers can add, remove, merge, or separate services through Kubernetes resources or annotations. · emissary-ingress.dev, 3 Oct 2026
- What it does
- Emissary-ingress is an open-source Kubernetes-native API gateway, Layer 7 load balancer, and Kubernetes Ingress built on Envoy Proxy. · emissary-ingress.dev, 3 Oct 2026
Where Emissary-ingress stands on Freedom251
- API Gateway Software#9 of 29