Why is kgateway more limited in functionality than Envoy Gateway?

[HamzaZo]

With the retirement of Ingress NGINX, I’ve been evaluating production-ready Gateway API implementations. Both Envoy Gateway and KGateway use Envoy as the data plane, but the gap in available features between the two is surprisingly large. This is confusing, especially because several fundamental capabilities, such as OIDC authentication, basic authentication (similar to what we could configure via Ingress annotations), and API key authentication are not available in kgateway.

With Ingress NGINX, we can expose the controller using a NodePort service, and all created VIPs use those NodePorts as backend ports. As a result, every Ingress resource created across the cluster routes traffic through those same ports. How does kgateway handle this scenario?

[yuval-k]

Short answer - because no one worked on them yet.

Longer version - It's a matter of priorities.
We just release version 2.1 and were very focused on that in the previous quarter.
Additionally, up until the last couple of weeks, we haven't gotten a lot of demand for these features. Recently (i assume because of the deprecation of nginx-ingress), we've been hearing a lot more requests for these. So to best help the community we plan to add API-keys and basic-auth soon for both agent-gateway and envoy data planes (~ hopefully a week or so)!

We are also happy to accept PRs for these if you feel like contributing.

Regarding your second question - you can adjust the service type to NodePort using the GatewayParameters object (in kube.service.type. see https://kgateway.dev/docs/latest/reference/api/#service).

[howardjohn]

API key and basic auth with Agentgateway actually already merged 🙂 #12886

[HamzaZo]

@yuval-k Do you mean we can create a single GatewayParameters resource with a static NodePort and reuse it across multiple Gateways in different namespaces?
Or does each Gateway require its own dedicated NodePort ?

[HamzaZo]

@yuval-k does kgateway support gzip compression? If yes can we configure gzip types ?

[yuval-k]

I'm not exactly sure what you need re GatewayParameters, but you can do it both ways. You can also assign one to the GatewayClass, and another one to the Gateway. The one on the GatewayClass will be the 'default' and the one on the specific gateway can tweak each gateway as needed.

re: gzip i don't believe it is currently supported - please open an issue so we can track it?

[HamzaZo]

I opened an issue for gzip compression #12914