$ show higress-group/higress
Higress is a cloud-native, AI-native API gateway built on Istio and Envoy. In production, it operates as a Kubernetes ingress controller, an AI/LLM proxy gateway, and a Wasm plugin host. The system ingests Kubernetes resource definitions (Ingress, Gateway API, custom CRDs like WasmPlugin, Http2Rpc, McpBridge) and translates them into Envoy xDS configurations, managing the full lifecycle of gateway routes, policies, and plugins. It provides a rich set of Wasm plugins (Go, Rust, C++, AssemblyScript) for authentication, rate limiting, request/response transformation, AI proxy (with 15+ LLM providers), semantic caching, RAG, MCP server hosting, and security (WAF, bot detection, IP restriction). The architecture is microservices-oriented: a control plane (Go-based ingress controller) manages Kubernetes resources and pushes config to Envoy data planes; a CLI tool (hgctl) handles installation, plugin development, and debugging; and a plugin release pipeline manages OCI image distribution with provenance verification. External dependencies include Kubernetes (client-go, controller-runtime), Istio (pilot, networking APIs), Envoy (Go filter API), and various AI/vector DB providers (OpenAI, Milvus, Pinecone, etc.).
The LLM identified 6 files worth highlighting for reuse:
Implements HTTP header validation for the Model Context Protocol (MCP) transport layer, including method, content-type, accept, origin, and q-value grammar checks. This component is self-contained, reusable for any MCP-compatible proxy or server, and demonstrates careful adherence to evolving MCP specifications.
Defines the abstract Provider interface for AI model backends, with methods for config validation, capability declaration, provider creation, and request/response transformation. This clean plugin architecture allows easy addition of new AI providers and is reusable across any AI proxy system.
Abstract interface for vector database providers, defining query and upload operations. Implementations exist for Milvus, Pinecone, Weaviate, Chroma, Qdrant, and others. This pattern enables swapping vector backends without changing cache logic and is reusable for any semantic search or caching system.
Efficient time-based sliding window counter for rate/cost tracking. Uses a ring buffer of buckets with configurable window size and granularity. This data structure is self-contained, reusable for any rate limiting or metrics aggregation, and demonstrates careful handling of time boundaries and concurrency.
Nested S-expression parser for evaluating template-based conditionals (e.g., (and (eq $var "value") (gt $count 5))). Supports logical operators, comparisons, and variable substitution. This component is reusable for any workflow or rules engine that needs safe, embeddable expression evaluation.
Secure template substitution engine for Kubernetes ingress configurations. Supports variable interpolation with namespace-based access control and secret reference resolution. This component is reusable for any system needing safe, context-aware config templating with security boundaries.