Help Center/ Cloud Container Engine/ User Guide/ Networking/ Gateway API/ Function Comparison Between Envoy Gateway and NGINX Ingress
Updated on 2026-06-05 GMT+08:00
View PDF
Share

Function Comparison Between Envoy Gateway and NGINX Ingress

In CCE clusters, Envoy Gateway (with Envoy as the data plane) and NGINX Ingress are both used for external traffic routing and load balancing. This section compares Envoy Gateway and NGINX Ingress to help you select the appropriate solution and plan migration.

Traffic Routing

Basic Routing

NGINX Ingress (Via Annotations)

Envoy Gateway (Via Gateway API)

Difference

Host routing

Supported

Envoy Gateway uses HTTPRoute hostnames to implement this function.

Path routing (prefix/exact)

Supported

Envoy Gateway uses HTTPRoute rules.matches.path to implement this function.

TLS termination (SNI multi-certificate)

Supported

Envoy Gateway uses Gateway listeners.tls to reference a secret and implement this function.

Redirecting HTTP to HTTPS

Supported

Envoy Gateway uses the HTTPRoute RequestRedirect filter to implement this function.

Forwarding to multiple backends

Supported

Envoy Gateway uses HTTPRoute backendRefs to support multiple backends.

Multi-port listening

Supported

Envoy Gateway uses Gateway listeners to implement this function.

Request/Response Modification

NGINX Ingress (Via Annotations)

Envoy Gateway (Via Gateway API)

Difference

Path rewriting

Supported

Envoy Gateway uses the HTTPRoute URLRewrite filter to implement this function.

Redirection

Supported

Envoy Gateway uses the HTTPRoute RequestRedirect filter to implement this function.

Request header modification

Supported

Envoy Gateway uses the HTTPRoute RequestHeaderModifier filter to implement this function.

Response header modification

Supported

Envoy Gateway uses the HTTPRoute ResponseHeaderModifier filter to implement this function.

Custom Nginx snippet injection

Not supported

Not supported by Envoy Gateway natively. Use EnvoyPatchPolicy to modify the underlying Envoy configuration.

Upstream Policies

NGINX Ingress (Via Annotations)

Envoy Gateway (Via Gateway API)

Difference

Timeout

Supported

Envoy Gateway uses HTTPRoute timeouts or BackendTrafficPolicy resources.

The implementation differs from NGINX: Envoy Gateway provides a more granular timeout mechanism with different configuration fields.

Retry

Supported

Envoy Gateway uses BackendTrafficPolicy resources with the following fields:

  • retry.numRetries: maximum number of retries allowed.
  • retry.retryOn: conditions under which retries are triggered.
  • retry.perRetry.timeout: timeout for an individual retry attempt.

Load balancing algorithms (such as RR and least_request)

Supported

Envoy Gateway uses BackendTrafficPolicy loadBalancer.type with the following options:

  • LeastRequest: Two instances are randomly selected by default, and the request is forwarded to the one with fewer active requests.
  • ConsistentHash: consistent hashing.
  • Random: random distribution.
  • RoundRobin: sequential polling.

Connection pool and circuit breaker

Supported

Envoy Gateway uses BackendTrafficPolicy circuitBreaker with the following fields:

  • circuitBreaker.maxConnections: maximum number of TCP connections between Envoy and the upstream service.
  • circuitBreaker.maxParallelRequests: maximum number of concurrent requests between Envoy and the upstream service. When this threshold is reached, new requests are rejected.

Sticky session (cookie stickiness)

Supported

Envoy Gateway uses consistent hashing for load balancing combined with the StatefulSession extension to implement this function.

Grayscale Release and Traffic Control

NGINX Ingress (Via Annotations)

Envoy Gateway (Via Gateway API)

Difference

Traffic distribution by weight

Supported

Envoy Gateway uses HTTPRoute backendRefs.weight to implement this function.

Traffic distribution by header/query

Supported

Envoy Gateway supports both headers and query parameters in HTTPRoute matches.

Traffic distribution by cookie

Supported

Envoy Gateway uses HTTPRoute matches (matching the cookie header) to implement this function.

Traffic mirroring

Supported

Envoy Gateway uses the HTTPRoute RequestMirror filter to implement this function.

Security

TLS Certificates

NGINX Ingress (Via Annotations)

Envoy Gateway (Via Gateway API)

Difference

TLS certificate management

Supported

Envoy Gateway implements this function via the Gateway TLS configuration.

TLS version/cipher suite

Supported

Envoy Gateway uses ClientTrafficPolicy resources for fine-grained TLS configuration.

Authentication

NGINX Ingress (Via Annotations)

Envoy Gateway (Via Gateway API)

Difference

Basic authentication

Supported

Envoy Gateway uses SecurityPolicy basicAuth to implement this function.

External authentication (OAuth2/OIDC/SSO)

Supported

Envoy Gateway uses SecurityPolicy oidc to implement this function.

Path/Method-based RBAC

Supported

Envoy Gateway uses SecurityPolicy authorization to implement this function.

Rate Limiting and Protection

NGINX Ingress (Via Annotations)

Envoy Gateway (Via Gateway API)

Difference

Rate limiting (by IP, header, or key)

Supported

Envoy Gateway supports both global and local rate limiting via BackendTrafficPolicy.

Max connections or concurrent connections

Partially supported

Envoy Gateway uses ClientTrafficPolicy and BackendTrafficPolicy resources to implement this function.

IP whitelist or blacklist

Supported

Envoy Gateway uses SecurityPolicy authorization to implement this function.
Parent Topic: Gateway API