Redesigning Ingress: Docker’s Transition To the Next-Gen Gateway API
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 15:00· Level 3 | ICC Capital Suite 14-16·
summary
Docker migrates HAProxy and Nginx to Envoy Gateway, consolidating auth, rate limiting and tracing into a single proxy and moving global rate limits to an Envoy rate limit service backed by Redis. Migration uses Route53 weighted DNS then ALB path rules for per-service canaries with instantaneous rollback, hitting an ALB rule 200 limit. Results show 4x throughput and 50% fewer cores, while gaps include no native Gateway API canary, reliance on XDS patching, and no secure remote Envoy admin access.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:25Legacy ingress pain points
- 3:53Envoy vs Traefik evaluation
- 5:59Gateway API choice
- 7:03New Envoy Gateway ingress
- 10:11Internal routing abstraction
- 12:18Migration benefits
- 13:21NLB to ALB swap
- 15:49Finalizing migration
- 16:30ALB traffic management
- 17:55Migration challenges
- 19:58XDS patching for unsupported features
- 21:43Canary support gap
- 23:07Envoy admin console security
- 24:31Contributing to Envoy
- 25:13Future plans
related talks
15mFrom ingress-nginx to Envoy Gateway at Zapier: The...
36mReplacing NGINX with Envoy in a Traffic Control System
37mGoodbye Ingress - Hello Gateway API
31mBehind the Scenes of Building a Gateway API Dataplane...
33mExiting Ingress With the Gateway API
37mJourney Through Kubernetes Ingress: Past, Present, and Beyond
43mMaximizing the Value of Your Rados Gateway with Ingress Strategies
37mEvolution of Envoy AI Gateway