Emissary-ingress (formerly Ambassador) is a Kubernetes-native API gateway and ingress controller built on Envoy Proxy. It sits at the edge of a Kubernetes cluster, managing ingress traffic with self-service configuration via Custom Resource Definitions (CRDs) like Mapping, Host, Module, AuthService, RateLimitService, and TLSContext. The system is architected as a dual-language control plane: a Go-based main entrypoint (`cmd/entrypoint/`) handles Kubernetes resource watching, snapshot assembly, secret reconciliation, and Envoy lifecycle management, while a Python-based configuration engine (`python/ambassador/`) compiles the desired state into an Intermediate Representation (IR) and generates Envoy xDS configuration (v3). A separate Go API extension server (`cmd/apiext/`) provides conversion webhooks and certificate management for CRD versions (v1, v2, v3alpha1). The compiled Envoy configuration is served via gRPC and pushed to Envoy through the ambex package using go-control-plane. Key data flows: Kubernetes resources (CRDs, Ingresses, Services) are watched by Go watchers and accumulated into snapshots via the `pkg/kates/accumulator`. Snapshots are passed to the Python diagd process, which builds an IR (Intermediate Representation) and generates Envoy v3 configuration for listeners, clusters, routes, filters (auth, rate limiting, gzip, CORS, tracing), and TLS settings. The resulting config is written as JSON files, read by the ambex ADS server, and pushed to Envoy. The system supports dynamic updates without restart, canary deployments, circuit breaking, health checks, Istio and Consul integration, and extensive observability (Prometheus, StatsD, Datadog). The codebase demonstrates strong engineering practices with a comprehensive test suite including Go unit tests, Python unit tests, Kubernetes integration tests (KAT framework), and e2e tests using chainsaw and k3d. It has a mature build system with multi-architecture Docker images, Helm charts, and automated release pipelines. While the dual-language architecture introduces some complexity and duplication (e.g., service name normalization in both Python and Go), the project is actively maintained with regular releases and a large community (4.5k stars, 700+ forks).