YARP (Yet Another Reverse Proxy) is a high-performance, extensible reverse proxy toolkit for .NET, built on ASP.NET Core. It provides a library and samples for creating custom proxy servers with features including request forwarding, load balancing (random, round-robin, least-requests, power-of-two-choices), active and passive health checks, session affinity (cookie, hash, ARR, custom header), request/response transforms, and telemetry consumption. The architecture is middleware-based, with a pipeline that includes routing, load balancing, session affinity, health checks, and delegation (Http.sys). Configuration is driven by immutable records and supports dynamic reload via change tokens. YARP also includes a Kubernetes Ingress Controller module that watches Ingress, Service, Endpoint, and Secret resources to dynamically configure the proxy. The codebase demonstrates strong engineering practices: extensive unit and functional tests, pluggable policy interfaces, efficient stream copying with telemetry, and a transform builder pattern for declarative request/response modifications. It is actively maintained by Microsoft and used in production scenarios.
Higress is a cloud-native, AI-native API gateway built on Istio and Envoy. In production, it operates as a Kubernetes ingress controller, an AI/LLM proxy gateway, and a Wasm plugin host. The system ingests Kubernetes resource definitions (Ingress, Gateway API, custom CRDs like WasmPlugin, Http2Rpc, McpBridge) and translates them into Envoy xDS configurations, managing the full lifecycle of gateway routes, policies, and plugins. It provides a rich set of Wasm plugins (Go, Rust, C++, AssemblyScript) for authentication, rate limiting, request/response transformation, AI proxy (with 15+ LLM providers), semantic caching, RAG, MCP server hosting, and security (WAF, bot detection, IP restriction). The architecture is microservices-oriented: a control plane (Go-based ingress controller) manages Kubernetes resources and pushes config to Envoy data planes; a CLI tool (hgctl) handles installation, plugin development, and debugging; and a plugin release pipeline manages OCI image distribution with provenance verification. External dependencies include Kubernetes (client-go, controller-runtime), Istio (pilot, networking APIs), Envoy (Go filter API), and various AI/vector DB providers (OpenAI, Milvus, Pinecone, etc.).
Traefik is a cloud-native reverse proxy and API gateway that dynamically configures itself from various service discovery backends (Docker, Kubernetes, Consul, etc.). It provides HTTP, TCP, and UDP routing, load balancing, TLS termination, ACME certificate management, a rich middleware chain (auth, rate limiting, compression, headers, etc.), observability (metrics, tracing, access logs), and a plugin system (Yaegi and Wasm). The project is written in Go with a React-based web UI. It supports Kubernetes CRDs (IngressRoute, Middleware, etc.) and the Gateway API. It has extensive integration tests and is actively maintained. The architecture is modular with clear provider interfaces, a configuration watcher that merges dynamic configs from multiple sources, and a hot-swappable handler for live updates.
Kong is a cloud-native, platform-agnostic API gateway built on OpenResty/Nginx. It provides traffic management, security, observability, and AI/LLM proxying capabilities through a plugin architecture. The system supports traditional, DB-less, and hybrid deployment modes, with an Admin API for configuration and Kong Manager for GUI-based management. Key features include load balancing, authentication, rate limiting, request/response transformation, and extensive observability integrations.
Emissary-ingress (formerly Ambassador) is a Kubernetes-native API gateway and ingress controller built on Envoy Proxy. It sits at the edge of a Kubernetes cluster, managing ingress traffic with self-service configuration via Custom Resource Definitions (CRDs) like Mapping, Host, Module, AuthService, RateLimitService, and TLSContext. The system is architected as a dual-language control plane: a Go-based main entrypoint (`cmd/entrypoint/`) handles Kubernetes resource watching, snapshot assembly, secret reconciliation, and Envoy lifecycle management, while a Python-based configuration engine (`python/ambassador/`) compiles the desired state into an Intermediate Representation (IR) and generates Envoy xDS configuration (v3). A separate Go API extension server (`cmd/apiext/`) provides conversion webhooks and certificate management for CRD versions (v1, v2, v3alpha1). The compiled Envoy configuration is served via gRPC and pushed to Envoy through the ambex package using go-control-plane. Key data flows: Kubernetes resources (CRDs, Ingresses, Services) are watched by Go watchers and accumulated into snapshots via the `pkg/kates/accumulator`. Snapshots are passed to the Python diagd process, which builds an IR (Intermediate Representation) and generates Envoy v3 configuration for listeners, clusters, routes, filters (auth, rate limiting, gzip, CORS, tracing), and TLS settings. The resulting config is written as JSON files, read by the ambex ADS server, and pushed to Envoy. The system supports dynamic updates without restart, canary deployments, circuit breaking, health checks, Istio and Consul integration, and extensive observability (Prometheus, StatsD, Datadog). The codebase demonstrates strong engineering practices with a comprehensive test suite including Go unit tests, Python unit tests, Kubernetes integration tests (KAT framework), and e2e tests using chainsaw and k3d. It has a mature build system with multi-architecture Docker images, Helm charts, and automated release pipelines. While the dual-language architecture introduces some complexity and duplication (e.g., service name normalization in both Python and Go), the project is actively maintained with regular releases and a large community (4.5k stars, 700+ forks).
Yggdrasil is an Envoy control plane that watches Kubernetes ingress resources across multiple clusters and generates dynamic configuration for Envoy proxies. It implements a modular architecture with separate packages for Kubernetes integration (pkg/k8s) and Envoy configuration generation (pkg/envoy). The system uses Kubernetes informers to watch resources, aggregates events from multiple clusters, translates ingress objects into Envoy listeners and clusters, and serves the configuration via xDS gRPC protocol. It also provides metrics and health endpoints for monitoring. The code demonstrates good separation of concerns, proper use of Kubernetes client-go patterns, and clean abstraction for handling multiple Kubernetes API versions.