Emissary-ingress (formerly Ambassador) is a Kubernetes-native API gateway and ingress controller built on Envoy Proxy. It sits at the edge of a Kubernetes cluster, managing ingress traffic with self-service configuration via Custom Resource Definitions (CRDs) like Mapping, Host, Module, AuthService, RateLimitService, and TLSContext. The system is architected as a dual-language control plane: a Go-based main entrypoint (`cmd/entrypoint/`) handles Kubernetes resource watching, snapshot assembly, secret reconciliation, and Envoy lifecycle management, while a Python-based configuration engine (`python/ambassador/`) compiles the desired state into an Intermediate Representation (IR) and generates Envoy xDS configuration (v3). A separate Go API extension server (`cmd/apiext/`) provides conversion webhooks and certificate management for CRD versions (v1, v2, v3alpha1). The compiled Envoy configuration is served via gRPC and pushed to Envoy through the ambex package using go-control-plane. Key data flows: Kubernetes resources (CRDs, Ingresses, Services) are watched by Go watchers and accumulated into snapshots via the `pkg/kates/accumulator`. Snapshots are passed to the Python diagd process, which builds an IR (Intermediate Representation) and generates Envoy v3 configuration for listeners, clusters, routes, filters (auth, rate limiting, gzip, CORS, tracing), and TLS settings. The resulting config is written as JSON files, read by the ambex ADS server, and pushed to Envoy. The system supports dynamic updates without restart, canary deployments, circuit breaking, health checks, Istio and Consul integration, and extensive observability (Prometheus, StatsD, Datadog). The codebase demonstrates strong engineering practices with a comprehensive test suite including Go unit tests, Python unit tests, Kubernetes integration tests (KAT framework), and e2e tests using chainsaw and k3d. It has a mature build system with multi-architecture Docker images, Helm charts, and automated release pipelines. While the dual-language architecture introduces some complexity and duplication (e.g., service name normalization in both Python and Go), the project is actively maintained with regular releases and a large community (4.5k stars, 700+ forks).
This repository is the official Helm chart collection for deploying Kong API Gateway and related operators (Kong Ingress Controller, Kong Gateway Operator, Kong Operator, Kong AI Gateway) on Kubernetes. It provides production-grade deployment templates with support for DB-less, PostgreSQL, hybrid mode, enterprise features, cert-manager integration, Prometheus monitoring, and admission webhooks. The architecture is a multi-chart Helm repository with subcharts for CRDs (kic-crds, gwapi-crds, ko-crds) and extensive CI snapshot testing via helm-chartsnap. Key entry points include the main `charts/kong/` chart for the gateway and ingress controller, `charts/kong-operator/` for the Kong Operator managing Konnect and AI gateway resources, and `charts/gateway-operator/` for the Gateway API operator. External dependencies include Kong container images, cert-manager, Bitnami PostgreSQL (optional), and Konnect SaaS for enterprise deployments. The repository is actively maintained with regular releases, changelogs, and upgrade guides, though CRDs are auto-generated and may drift from upstream operator versions.